# Replit — How Replit is Protecting You From the "Shai-Hulud" Worm

- Company: Replit (replit.com)
- Announced: 2025-09-18T22:20:48+00:00
- Category: safety-policy-update
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://replit.com/blog/npm-supply-chain-attack
- Record: https://forck.live/items/17939-how-replit-is-protecting-you-from-the-shai-hulud-worm
- Subject: Replit Agent

Replit blocked the exfiltration endpoint used by the Shai-Hulud worm across all development environments and upgraded its Security Scanner with a Malicious File Detection feature to detect known malicious files from the attack. The AI agent can automatically remediate issues such as removing malicious files and updating to safe package versions.

## Evidence

Verbatim from https://replit.com/blog/npm-supply-chain-attack:

> To ensure Replit users don't have their credentials stolen, we blocked the exfiltration endpoint across all development environments. This measure prevents the compromised packages from transmitting harvested credentials to the attacker's webhook endpoint, neutralizing the threat.

---

Record: https://forck.live/items/17939-how-replit-is-protecting-you-from-the-shai-hulud-worm
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md