How to pronounce Shai-Hulud

Shai-Hulud is most commonly pronounced "shy hoo lude" (/ˌʃaɪ huˈluːd/). This is the widely-used reading among engineers, though edge cases exist.

Shai-Hulud is the self-replicating npm supply-chain worm that hit thousands of packages from September 2025 through the "Shai-Hulud 2.0" and "Mini Shai-Hulud" waves, drawing a CISA alert and Microsoft/Unit 42 advisories; it is named for the Dune sandworm. Say it "shy-hoo-LOOD" with stress on the last syllable, from Arabic shay' khulud ("thing of immortality") — the reading used in the Dune films and in Frank Herbert's own recorded readings. Cold readers reach for "SHAY hyoo-lud" or "shy-HULL-ud"; a reduced middle vowel ("shy-huh-LOOD") is a valid variant.

Alternate readings you might hear:

• "shy huh lude" /ˌʃaɪ həˈluːd/

Source: Wikipedia — Sandworm (Dune): name derived from Arabic shay' khulud, "thing of immortality"

Pronouncing project and product names correctly avoids the small but persistent friction of being gently corrected during standups, conference Q&As, and team calls. Hearing the word a few times locks in the right reading better than reading IPA ever will. Pronounce is a community-maintained dictionary — every entry tagged with a confidence level and (where possible) a citable source.