The NPM Worm Is Back - Threat Wire

Quick Overview

Cloudflare experienced a major outage on November 18, 2025, caused by a bug in the bot mitigation service that crashed after a routine configuration change, which resulted in the temporary widespread unavailability of many major internet providers and services. The attacker group Shai Hulud, known for previous supply-chain attacks, was not involved in this incident, despite initial confusion caused by the status page being affected.

Key Points: Cloudflare experienced a major outage on November 18, 2025, lasting about six hours, with most services restored within three hours. The outage was caused by a bug in the bot migration service that crashed following a routine configuration change, not a cyberattack, contrary to initial speculation. The bug caused the feature file used by the bot management system to double in size, which then propagated across all machines, leading to degradation of network services. The attacker group Shai Hulud, known for supply-chain attacks like the one on NPM packages in August 2023, was not responsible for this specific Cloudflare failure. The incident exposed the risk associated with relying heavily on core infrastructure providers, as many major companies, including Zapier, ENS, PostHog, and banks, were affected. WatchTower research found that code formatters are unsafe for sharing sensitive data, as they often expose secrets like API keys and database credentials via publicly accessible GitHub repositories, with over 26.3k such repositories exposed.

Context: The video, an episode of Threat Wire hosted by Allie Diamond, discusses two separate but significant cybersecurity incidents. The primary focus is the widespread Cloudflare outage that occurred on November 18, 2025, which disrupted large portions of the internet. The secondary topic addresses the ongoing threat of supply-chain attacks, specifically highlighting the malicious activities of the Shai Hulud group targeting the NPM ecosystem and the general danger of using unvetted online code formatting tools.