Shai-Hulud 2.0: Inside the Most Sophisticated npm Supply Chain Attack of 2025

Most software supply chain attacks target a single package, compromise a single maintainer, and create a localized incident. Shai-Hulud was architected differently. It infected npm packages, hijacked CI/CD pipelines, harvested cloud credentials, and built a self-reinforcing infection network that continued spreading even after initial packages were removed. By the time Shai-Hulud 2.0 launched in late November 2025, it had compromised approximately 796 npm packages with a combined weekly download count in the tens of millions.

What Shai-Hulud Is and How the First Wave Unfolded

Shai-Hulud is a self-replicating npm supply chain worm that spreads by inserting malicious preinstall scripts into JavaScript and Node.js packages. In its first wave in September 2025, it compromised more than 500 npm packages, including the widely used @ctrl/tinycolor library. Once installed, the malicious code harvested npm tokens and cloud credentials, then exfiltrated them to a publicly created GitHub repository named “Shai-Hulud.”

That first wave established the pattern: a single compromised package silently propagating through dependency chains, abusing the trust developers place in packages they install daily.

How Shai-Hulud 2.0 Hijacked npm Packages and CI/CD Pipelines

Two months later, Shai-Hulud 2.0 returned with a significantly more advanced attack architecture. The initial infection began during the preinstall phase of a compromised npm package, where a modified package.json executed setup_bun.js, a script that appeared to install the Bun JavaScript runtime but was actually staging the malware execution environment.

By switching from Node.js to Bun, a runtime not commonly monitored by security tools at the time; the attackers bypassed conventional detection mechanisms. Bun then launched a heavily obfuscated 10MB payload named bun_environment.js, giving the malware an early execution foothold inside developer and CI/CD environments before standard runtime protections were engaged. This “bring your own runtime” technique is one of the most operationally significant elements of the campaign.

Automated Credential Harvesting Across Cloud and Developer Environments

Once executing, Shai-Hulud 2.0 activated an automated credential harvesting routine targeting every high-value secret source a developer or CI system might carry. It scanned environment variables and CLI configurations for GitHub personal access tokens (ghp) and OAuth tokens (gho), retrieved npm publishing tokens from .npmrc files, and enumerated cloud credentials from AWS, GCP, and Azure using provider SDKs and metadata endpoints.

To extend discovery beyond immediately accessible paths, the malware downloaded and executed TruffleHog, scanning the filesystem recursively for secrets embedded in configuration files, .env files, source repositories, and git history using both high-entropy detection and pattern matching. It also captured the full process.env runtime environment, scooping transient tokens like GITHUB_TOKEN and AWS_ACCESS_KEY_ID that would otherwise disappear after the session ended.

GitHub-Based Persistence and Self-Replicating CI/CD Compromise

After credential extraction, the malware embedded persistence through GitHub Actions workflow injection, delivering a rogue .github/workflows/shai-hulud-workflow.yml file via a base64-encoded Bash script. The workflow triggered push events and transmitted repository secrets to a command-and-control endpoint. The malware also force-created branches via the GitHub /git/refs API and registered compromised machines as self-hosted GitHub runners, ensuring attackers retained remote code execution capability even after malicious packages were removed from the registry.

For exfiltration, Shai-Hulud routed stolen credentials through GitHub’s own API by creating public repositories with the description “Shai-Hulud: The Second Coming” and uploading harvested secrets as actionsSecrets.json files. By routing exfiltration through legitimate GitHub infrastructure over encrypted HTTPS, the malware blended into standard repository traffic and bypassed conventional network security controls.

How to Detect Shai-Hulud Compromise Across npm, GitHub, and CI/CD

Defenders need to check across the full development lifecycle. Key indicators of compromise include unexpected preinstall scripts like setup_bun.js in package.json, the presence of large, obfuscated files like bun_environment.js, base64-encoded or newly added workflow YAML files under .github/workflows/, unauthorized self-hosted runners registered in GitHub organizations, and public repositories with the “Shai-Hulud: The Second Coming” description.

On the filesystem, malware-generated JSON files including cloud.json, contents.json, and truffleSecorganisationsfirm successful credential harvesting. In CI/CD logs, TruffleHog executing outside approved workflows is a reliable indicator of automated secrets extraction. Reviewing npm publish logs for unauthorized version increments or publishes from unusual IPs completes the audit picture.

What Shai-Hulud Reveals About Modern Software Supply Chain Security

The structural lesson from Shai-Hulud is that npm ecosystem security cannot rely solely on package removal after the fact. The attack demonstrated how stolen publishing tokens enable recursive reinfection through downstream dependency chains, how CI/CD pipeline compromise can outlast package-level remediation, and how abusing legitimate infrastructure like GitHub’s API makes attacker activity indistinguishable from normal developer operations.

Treating dependency oversight, CI/CD credential hygiene, and supply chain telemetry as first-class security requirements is no longer optional. Shai-Hulud did not exploit a single misconfiguration. It exploited the systemic trust that modern software development depends on, and it did so at scale, automatically, and with surgical anti-forensic precision.

Read the full Article on Loginsoft: Shai-Hulud 2.0: Inside the Most Sophisticated Supply-Chain Attack