Security LabInspect with AI
← Incident database

postman-shai-hulud-2025 · Disclosed 2025-11-24

Postman: poisoned dependencies exposed CI publishing authority

A CI build without an appropriate lockfile installed infected dependencies, enabling misuse of an npm publishing token. Postman reported 17 hijacked packages, with production apps and customer data unaffected.

Supply chain / CICredentialsConfiguration / exposure

Outcome: Confirmed breach

Entry path and evidence

  • Reported fact

    GitHub Actions installed infected AsyncAPI packages; a publishing token could publish to 17 packages lacking the disallow-tokens/two-factor setting.

    [s1]How did it happen?
  • Reported fact

    Infected versions of 17 public npm packages were distributed; Postman attributes production and customer-data isolation to segmented environments.

    [s1]What happened?

Timeline

  1. Incident disclosed. [s1] [s2]

Reported response

  • Reported fact

    Postman revoked the account’s tokens, removed infected versions, restricted publishing access, enabled OIDC Trusted Publishers, and began checking lockfiles.

    [s1]How did it happen? / What we have already done

Cause and mitigation hypotheses

These are editorial hypotheses, separate from established causes and reported responses. Supporting and challenging observations are checks to investigate, not collected evidence.

  1. Mitigation hypothesis 1 Unverified

    A reviewed lockfile and frozen install could reduce unintended adoption of newly compromised versions in CI.

    Primary-source starting point

    Postman attributes infected dependency installation to a build lacking an appropriate lockfile.

    [s1]How did it happen?

    Read assumptions, observations, and limits
    Required assumptions
    • Approved dependencies are not already infected and lockfile updates are reviewed.
    Observations that would support it
    • CI configuration and isolated build records confirm frozen installation that fails on manifest mismatch.
    Observations that would challenge it
    • The lockfile is ignored or regenerated, or it already includes a compromised version.
    Assessment limits
    • Lockfiles do not prove code safety; dependency review and restricted publishing authority remain necessary.

    Related inspection rules

  2. Mitigation hypothesis 2 Unverified

    Removing standing publishing tokens from dependency-executing CI and restricting release authority could curb malicious redistribution.

    Primary-source starting point

    The infected build misused publishing authority; Postman reported revocation and an OIDC transition.

    [s1]How did it happen? / What we have already done

    Read assumptions, observations, and limits
    Required assumptions
    • Build and publishing can be separated and OIDC issuance restricted to an approved workflow.
    Observations that would support it
    • Workflow permissions and publisher configuration show no standing token and deny release authority to other jobs.
    Observations that would challenge it
    • Dependency execution still shares publishing authority, or legacy tokens and other workflows can publish.
    Assessment limits
    • OIDC alone is insufficient; compromise of the trusted publishing job or artifact can still enable redistribution.

    Related inspection rules

Read this incident’s AI-ready guide ↗

Evidence relevant to prevention

Operational controls to inspect

Inspect lockfiles, frozen installs, CI publishing authority, and long-lived tokens; lockfiles alone do not establish dependency safety.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence.

This record covers Postman packages rather than the whole campaign. Source timestamps use PT; an initial-entry UTC date is not assigned here.

Sources

  1. [s1] Postman · Primary source

    Root Cause Analysis: Shai-Hulud 2.0 ↗

    Published 2025-12-04 · Reviewed 2026-10-10

  2. [s2] Postman · Primary source

    Shai-Hulud 2.0 npm supply-chain attack ↗

    Published 2025-11-24 · Reviewed 2026-10-10