- Hundreds of npm packages were compromised by a self-replicating worm dubbed Shai-Hulud, with GitHub removing 500+ tainted versions.
- The malware steals secrets (npm tokens, GitHub PATs, cloud keys) and republishes infected packages using victims' publishing rights.
- Evidence points to Linux and macOS targeting, TruffleHog abuse, and a GitHub Actions workflow that exfiltrates data.
- Immediate steps: rotate tokens, audit dependencies and GitHub repos, enforce MFA/2FA, and hunt for IoCs including bundle.js and webhook.site traffic.
What began as another supply‑chain scare in the JavaScript world has escalated into a large incident affecting the npm ecosystem. Reports across multiple sources confirm a self‑propagating malware strain, tracked as Shai‑Hulud, that compromises developer credentials, exposes code, and republishes tainted packages to keep the infection rolling.
While counts differ by source, the consensus is clear: we’re dealing with hundreds of poisoned releases, including a widely used library downloaded millions of times per week. GitHub removed over 500 compromised versions to stem the spread, and security teams worldwide are urging developers to rotate credentials and comb through their repos and pipelines for clues of intrusion.
What happened and why it matters
Investigations indicate the operation likely began with credential‑harvesting lures spoofing npm, nudging maintainers to “update” MFA settings. With access in hand, the threat actor deployed a worm that runs after install, hunts for secrets, and republishes infected builds under the victim’s identity—turning trusted maintainers into amplifiers of the attack.
Shai‑Hulud combines two dangerous ideas: automated propagation and secrets theft. It abuses stolen npm tokens to publish new versions of packages and leverages GitHub tokens and cloud keys (AWS, GCP, Azure) to move laterally and exfiltrate data. This pairing supercharges the blast radius, letting one compromise ripple across countless downstream users.
Targets appear skewed toward Unix‑like systems. Analysis notes that most malicious logic executes on Linux and macOS, based on environment checks, though the secrets‑discovery phase (notably with TruffleHog) can occur more broadly. That focus narrowed the worm’s footprint but still left a wide range of developer machines exposed.
Packages from several notable organizations were impacted along with popular community modules. In one high‑profile example, the @ctrl/tinycolor package—downloaded millions of times weekly—was pulled into the fray, demonstrating how deeply the infection could burrow into the dependency graph.
How the worm works (technical breakdown)
The core payload ships as a hefty JavaScript file, commonly named bundle.js (over 3 MB in observed samples). It executes via a postinstall hook added to package.json, which means the malicious code runs automatically right after a user installs the package from npm.
Inside bundle.js are modules for GitHub API interaction, cloud SDKs (AWS/GCP), networking helpers, and routines to run TruffleHog for secret discovery. The script inventories the OS, locates an npm token, and checks for a valid GitHub token; if none is found, it bails—otherwise it starts exfiltration and replication.
A notable quirk: some infected packages contained an archive named package.tar instead of the usual naming convention, a tell that helped researchers flag compromised artifacts. Analysts also observed a variant that executed as a preinstall hook; one early case cited was ngx‑bootstrap 18.1.4, which may have served as an initial beachhead in the spread.
Once running, the malware enumerates the developer’s most downloaded packages via the npm search API, unpacks each tarball, drops bundle.js, injects a postinstall command, bumps the version, and republishes to npm with the victim’s token. This turns the developer’s portfolio into a vehicle for further infections.
Secrets exfiltration and GitHub workflows
For credential harvesting, Shai‑Hulud scans for npm tokens, GitHub Personal Access Tokens, and cloud API keys (AWS, GCP, Azure). It then creates a public GitHub repo named ‘Shai‑Hulud’ under the victim’s account, committing a data file (e.g., data.json) with the stolen secrets—effectively exposing them to the world.
In parallel, researchers observed a crafty GitHub Actions angle: the worm creates a branch named ‘shai‑hulud’ across accessible repositories and pushes a workflow file (shai‑hulud‑workflow.yml). Triggered on pushes, the workflow collects secrets and ships them to attacker infrastructure, sometimes after double Base64 encoding to obfuscate content in transit.
There’s also evidence of a migration script that clones private/Internal repos from organizations the victim can access, re‑hosting them in the user’s account as public mirrors. The goal appears to be automated source‑code theft from private projects, increasing the pressure on affected organizations.
Multiple reports note artifacts of AI assistance within the bash scripts (comments and even emojis), suggesting the attacker may have used an LLM to accelerate development of the malware’s automation components.
Scope and notable packages
Across coordinated takedowns, GitHub removed 500+ compromised versions to break the worm’s propagation. While the exact total continues to evolve, the list spans numerous ecosystems and orgs, with downstream impact to developers who updated during the active window.
Among frequently cited packages and namespaces: @ctrl/tinycolor (millions of weekly downloads), multiple @crowdstrike/* components (such as commitlint and UI libraries), and a wide array of community modules including ngx‑bootstrap, ng2‑file‑upload, ngx‑toastr, and more. CrowdStrike indicated that its core platform remained unaffected and that keys were rotated promptly after detecting malicious entries in the public registry.
- Examples tied to the wave: @ctrl/tinycolor; @crowdstrike/commitlint; @crowdstrike/foundry‑js; @crowdstrike/glide‑core; ngx‑bootstrap; ng2‑file‑upload; ngx‑toastr; @nativescript‑community/*; @teselagen/*; @things‑factory/*; and others.
- Researchers also saw multiple malicious versions per package in some cases—likely due to the worm spreading via several maintainers’ accounts within the same project.
Platform response and security changes
GitHub’s immediate actions included purging known bad packages from npm and blocking uploads matching Indicators of Compromise (IoCs). The company is also rolling out stricter publishing controls: mandatory 2FA for local publishing, shorter‑lived granular tokens (e.g., seven days), and broader adoption of Trusted Publishing to reduce reliance on long‑lived secrets.
Forthcoming changes will deprecate legacy classic tokens and TOTP‑based 2FA for publishing, default to disallow token publishing, and expand providers for Trusted Publishing. GitHub has signaled a gradual rollout with documentation and migration guides, recognizing that some workflows will need adjustment.
Threat intel and incident‑response teams across the industry (including Unit 42, Kaspersky, Trend Micro, and others) have issued guidance and detections while sharing IoCs with peers and alliances to accelerate protection updates.
How to reduce risk right now
Move quickly under the assumption that any developer machine that installed npm packages recently may have leaked secrets. The priority is to contain credentials abuse, stop persistence, and eliminate tainted dependencies from build chains.
- Rotate npm tokens, GitHub PATs/SSH keys, and cloud credentials (AWS/GCP/Azure) immediately; consider all secrets present on developer hosts compromised.
- Audit dependencies via package‑lock.json/yarn.lock; remove or pin away from known compromised versions; re‑install from clean sources.
- Enforce MFA/2FA across GitHub and npm; move to Trusted Publishing where possible to cut long‑lived tokens out of the loop.
- Scrutinize GitHub for unexpected public repos named ‘Shai‑Hulud’, unfamiliar branches or workflows, and anomalous Actions runs.
- Harden CI/CD with least‑privilege RBAC, artifact signing/verification, and continuous SCA scanning; treat open‑source consumption as a managed risk.
Threat hunting tips (high‑signal checks)
Look for outbound connections to webhook.site domains, particularly the URI observed in multiple reports. On endpoints, search for the presence of bundle.js in temporary or package directories and for a GitHub Actions file named shai‑hulud‑workflow.yml.
- Network telemetry: DNS/URL logs containing webhook.site; flag the specific path bb8ca5f6‑4175‑45d2‑b042‑fc9ebb8170b7 if seen.
- File telemetry: creation or execution of bundle.js; the presence of shai‑hulud‑workflow.yml on Linux/macOS developer hosts.
- Process telemetry: TruffleHog invocations where not expected (note legitimate use may exist in some orgs).
Indicators of compromise (IoCs)
File and string clues seen across investigations include bundle.js and shai‑hulud‑workflow.yml, with the literal string ‘shai‑hulud’ appearing in branches, repos, and workflows.
- Files: bundle.js; shai‑hulud‑workflow.yml
- Strings: shai‑hulud; package.tar
- Hashes (selected): 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09; b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777; dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c; 4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db; C96FBBE010DD4C5BFB801780856EC228; 78E701F42B76CCDE3F2678E548886860
- Network: https://webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7 (variants and subpaths observed)
Timeline and ongoing analysis
Reports attribute initial discovery to mid‑September 2025, with peak containment actions around September 16–19. GitHub and multiple vendors have since updated protections, detections, and guidance. Expect further retroactive findings as organizations finish incident reviews and expand lists of affected versions.
Some evidence suggests that the incident built on prior secret leaks, underscoring how long‑lived tokens and cached credentials can fuel fresh waves of compromise months later. This should reinforce efforts to shorten token lifetimes and adopt publishing models that minimize secret sprawl.
Not every report agrees on exact totals or first‑in‑chain packages, but the general picture aligns: a self‑replicating npm worm that weaponized developer trust and automated publishing rights to scale fast—faster than many teams could detect by manual review alone.
The event illustrates how quickly modern build pipelines can turn into highways for malware. By tightening authentication, removing long‑lived tokens from the path, hardening CI/CD, and aggressively hunting for IoCs, organizations can contain exposure today and make the next wave far harder to execute.
