NPM-SHAI-HULUD-2-2025
npm · @asyncapi/*, @posthog/*, Zapier, ENS packages (Shai-Hulud 2.0)
Summary
Shai-Hulud is the nightmare the npm ecosystem had long feared: a self-replicating worm. First seen in September 2025 and back in a more aggressive wave around 21-24 November 2025 ("The Second Coming"), it does not just poison one package and wait. When its malware runs in a developer's environment, it harvests every secret it can find, npm tokens, GitHub tokens, cloud keys, then uses those stolen npm tokens to automatically publish itself into other packages the victim maintains, spreading from maintainer to maintainer on its own. The second wave hit more than 25,000 GitHub repositories across roughly 500 compromised accounts, leaked the stolen secrets into public repos, and, if it failed to steal credentials, tried to wipe the victim's home directory. It is the moment supply-chain malware learned to propagate like a biological infection.
How it happened
Named after the sandworm in Dune, Shai-Hulud runs a self-sustaining loop. A developer installs an infected package. The malware, in this wave executing in the pre-install phase so it runs before installation (and before tests or security checks) even finishes, scans the machine for secrets using the TruffleHog scanner and other tools: npm publish tokens, GitHub access tokens, and cloud keys for AWS, GCP, and Azure. It exfiltrates them by creating public GitHub repositories (labelled "Sha1-Hulud: The Second Coming") and dumping the stolen credentials there. Then comes the part that makes it a worm rather than a one-off supply-chain attack: it uses the stolen npm publish token to republish the malware into the first 100 packages that victim maintains, turning each compromised developer into a new launch point for the next round.
The 2.0 wave was nastier than the first. Where the September wave ran from post-install scripts, this one carried a large (over 10 MB), heavily obfuscated payload executed through the Bun JavaScript runtime, moved execution into the pre-install phase, registered the compromised host as a self-hosted GitHub Actions runner (named "SHA1HULUD") for persistent remote access, and added a destructive fallback: if it could not find a working GitHub token, npm credentials, or any exfiltration channel, it attempted to delete the victim's entire home directory.
The damage
The second wave reached more than 25,000 GitHub repositories across roughly 500 accounts and 150-plus organisations, trojanising around 796 npm packages (over a thousand versions) from organisations like AsyncAPI, PostHog, Postman, Zapier, and ENS. AsyncAPI's own postmortem traced its compromise to a three-year-old npm publishing token, a textbook argument for short-lived, scoped credentials. The real payload was secrets at ecosystem scale, thousands of credentials harvested and leaked, each one a potential foothold into a company's cloud or code. The destructive fallback turned it from pure theft into sabotage. It was the centrepiece of a 2025 in which npm supply-chain attacks stopped being isolated incidents and became self-replicating, ecosystem-wide events.
Why Shai-Hulud still matters
Shai-Hulud is a structural escalation: the first major self-propagating npm worm, where a single infected install can cascade across the ecosystem through stolen publish tokens, and where the payload is mass credential theft. The defences target the propagation mechanism: require phishing-resistant 2FA and use short-lived, narrowly scoped publish tokens so a stolen one cannot be reused to self-publish; run installs and CI in isolated, least-privilege environments with no standing cloud credentials; disable install scripts where feasible; scan continuously for leaked secrets and rotate fast; and pin dependencies so a freshly poisoned version cannot flow straight into your builds. It shares 2025 with the qix chalk and debug compromise, the year npm's trust model truly buckled. And this was not the end of it: in 2026 the worm's code was open-sourced as Mini Shai-Hulud and reused in incidents like the @redhat-cloud-services Miasma compromise, turning a single campaign into a commodity technique. The full arc is traced in the Shai-Hulud lineage.
How to fix it
- Treat every machine that ran an infected package as fully compromised: rotate every credential it could reach, especially npm and GitHub tokens, and revoke the worm's published versions.
- Search GitHub for the worm's exfiltration repositories to find which of your secrets leaked, and rotate those first; remove any self-hosted runner it registered.
- Pin to known-good versions, rebuild from a clean lockfile, and check your own published packages for unauthorized releases the worm may have pushed.
How to avoid it
- Require phishing-resistant 2FA and use short-lived, narrowly scoped publish tokens so a stolen token cannot be reused to self-propagate.
- Run installs and CI in isolated, least-privilege environments with no standing cloud credentials, and disable install scripts where feasible.
- Scan continuously for leaked secrets and rotate fast; the worm's entire purpose is harvesting credentials.
- Pin dependencies and gate updates so a freshly poisoned version cannot flow straight into your builds.
References
- https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
- https://unit42.paloaltonetworks.com/npm-supply-chain-attack/
Related vulnerabilities
All Supply chain →- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- CRITICALNPM-SHAI-HULUD-2025
Shai-Hulud, in September 2025, was the moment the npm ecosystem's oldest nightmare came true: a worm that spreads by itself. It began with a wave of compromised packages, the most prominent being @ctrl/tinycolor (over two million weekly downloads), and from there it did something no npm attack had done before. When its malware ran on a developer's machine, it hunted for every credential it could find, then used the developer's own npm token to republish itself into all of their other packages automatically, with no attacker involvement, jumping from maintainer to maintainer like an infection. More than 500 packages were compromised, including some from CrowdStrike. It is the first true npm worm (tracked as GHSA-6m4g-vm7c-f8w6 and GHSA-f3v2-259r-f6jc), the template for the more aggressive Second Coming that followed weeks later, and the ancestor of an entire 2026 lineage that ended with the worm's code being open-sourced for anyone to reuse.
- HIGHCVE-2025-30066
tj-actions/changed-files was one of the most widely used GitHub Actions on the planet, wired into the CI pipelines of more than 23,000 repositories just to list which files a pull request touched. On 14 March 2025 it was turned into a weapon. An attacker who had stolen the credentials of the project's bot account rewrote nearly every version tag, from v1 all the way to v45.0.7, so they all pointed at one malicious commit. Any pipeline that pulled the action then ran code that dumped the build runner's memory and printed the secrets it found, AWS keys, GitHub tokens, npm tokens, private keys, straight into the workflow logs. Tracked as CVE-2025-30066, it is the defining modern CI/CD supply chain attack, and a blunt lesson that a version tag is a sticky note, not a lock.
- HIGHCVE-2026-62680
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)