Check if your system was compromised by the npm supply chain attack
This lookup service allows you to check if your system's hostname or username appeared in data exfiltrated by the Sha1-Hulud: The Second Coming npm supply chain attack discovered in November 2025.
The attack compromised hundreds of npm packages and exfiltrated system information to GitHub repositories. This service indexes that exfiltrated data to help affected users identify if their systems were compromised.
What to do if you're affected: Review your systems for unauthorized access, rotate credentials, and check for any malicious GitHub Actions workflows.