2025 Postman — npm worm ('Shai-Hulud 2.0') compromised maintainer session to publish malicious versions of Postman-owned packages
Data compromised
Downstream developers who installed poisoned package versions during the narrow window (supply-chain risk); Postman asserted no broader customer database exfiltration.
Technical writeup
Postman Engineering published a root-cause analysis describing a self-replicating npm worm that leveraged a maintainer session to publish malicious package versions for roughly six hours; Postman stated no customer or Postman service data was impacted and summarized IOCs, revoked tokens, and future hardening.
Root cause
Unauthorized publishing to npm using compromised maintainer credentials/session per vendor incident report.