We know you’re all pumped for Namechain. But we’re not just building an L2 — we’re building a whole new ENS. Today, we’re launching the ENSv2 Hub: a single place to learn about everything that’s coming and stay up to date on our progress. https://ens.domains/ensv2 🧵👇
- 5 replies
- 6 recasts
- 40 reactions
UPDATE: All affected npm package versions have been removed, and it appears there were zero downloads of these compromised versions. Our investigation found that the malicious script originated from a separate project, unrelated to ENS Labs’ core code. This project ran a postinstall script for a PostHog dependency that contained the Shai Hulud malware. The impacted development environment was disconnected, and all publishing credentials are being rotated. We are also strengthening our repositories and deployment procedures to further reduce the likelihood of future supply chain attacks.
- 0 replies
- 1 recast
- 10 reactions
We have identified that certain npm packages starting with @ensdomains published around 5:49am UTC today may be affected by a Sha1-Hulud supply-chain attack that has compromised over 400 NPM libraries, including several ENS packages. The team has updated all latest tags and is proceeding with key rotations and currently attempting to unpublish all impacted versions. USERS: Current reviews indicate that ENS Labs-operated websites, including app.ens.domains, have not shown signs of impact related to this issue. At this time, there is no evidence that names have been affected. DEVS: If you have not installed ENS packages within the past 11 hours [since 5:49am UTC on November 24, 2025], there is no indication you are affected. If you have, please refer to the following link with a list of affected packages and install the latest version.
- 2 replies
- 6 recasts
- 22 reactions