Root Cause Analysis: Shai-Hulud 2.0

Postman Security knows that trust begins with transparency. So we are following up (as promised!) on the Shai Halud attack we first posted about on Nov 24, 2025. No Postman or customer data was impacted in this incident. What happened? On November 24, 2025, 17 public Postman NPM packages were hijacked by the “Shai-Hulud” worm. These infected versions were published to NPM, and infected packages…

This is an excerpt. The full article continues at Postman.