Shai-Hulud 2.0 npm supply-chain attack
Update: our RCA has been posted here.
Postman has discovered unusual activity in our NPM org relating to the ongoing “Shai-Hulud 2.0 npm supply-chain attack.”
Our security engineering team is investigating the matter and thus far has concluded that while some public Postman NPM packages were infected, (1) Postman as an app is not compromised, and (2) our production cloud services are also not compromised.
All infected Postman NPM packages have been unpublished as of 3:30am PT on November 24th, 2025.
Below is a timeline of the incident:
- 11/23/25, 9:00pm PT: infected packages published
- 11/24/25, 2:11am PT: The 13 packages that could be unpublished by Postman were unpublished. The remaining four had public dependencies and could not be unpublished by Postman due to NPM restrictions; they were instead marked as deprecated, and NPM support was contacted to unpublish.
- 11/24/25, 7:58am PT: NPM Support unpublished the remaining compromised versions.
If you believe you may have downloaded impacted NPM packages within that timeframe, you can find the list of (now unpublished) infected package versions below. Delete and pull fresh versions of the following packages if found in your systems.
17 packages have been affected with 51 versions published:
@postman/aether-icons 2.23.2, 2.23.3, 2.23.4
@postman/csv-parse 4.0.3, 4.0.4, 4.0.5
@postman/final-node-keytar 7.9.1, 7.9.2, 7.9.3
@postman/mcp-ui-client 5.5.1, 5.5.2, 5.5.3
@postman/node-keytar 7.9.4, 7.9.5, 7.9.6
@postman/pm-bin-linux-x64 1.24.3, 1.24.4, 1.24.5
@postman/pm-bin-macos-arm64 1.24.3, 1.24.4, 1.24.5
@postman/pm-bin-macos-x64 1.24.3, 1.24.4, 1.24.5
@postman/pm-bin-windows-x64 1.24.3, 1.24.4, 1.24.5
@postman/postman-collection-fork 4.3.3, 4.3.4, 4.3.5
@postman/postman-mcp-cli 1.0.3, 1.0.4, 1.0.5
@postman/postman-mcp-server 2.4.10, 2.4.11, 2.4.12
@postman/pretty-ms 6.1.1, 6.1.2, 6.1.3
@postman/secret-scanner-wasm 2.1.2, 2.1.3, 2.1.4
@postman/tunnel-agent 0.6.5, 0.6.6, 0.6.7
@postman/wdio-allure-reporter 0.0.7, 0.0.8, 0.0.9
@postman/wdio-junit-reporter 0.0.4, 0.0.5, 0.0.6
Our RCA of this event has been posted.
Postman remains committed to protecting our customer data, and will provide status updates as appropriate in the Postman Security Trust Portal over the coming days. If you have concerns, please reach out to Customer Support.
A previous version of this post cited “11/24/25, 3:30am PT: containment achieved (all infected versions unpublished)” and has been updated to reflect new information.