Miasma / Shai-Hulud Supply-Chain Campaign Pushes Password-Stealing Malware via Compromised Microsoft GitHub Repos (durabletask PyPI 1.4.1-1.4.3)
Miasma / Shai-Hulud Supply-Chain Campaign Pushes (TL-2026-0733), also tracked as Shai-Hulud, is a high-severity supply-chain compromise, first published 2026-06-09. It is attributed to Shai-Hulud worm operators with low confidence, affects Microsoft GitHub repositories (Azure, microsoft, Azure-Samples, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1059), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0733
- Threat ID
- TL-2026-0733
- Also known as
- Shai-Hulud, Shai-Hulud 2.0, Sha1-Hulud: The Second Coming, Miasma, IronWorm, Mini Shai-Hulud
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-09
- Last reviewed
- 2026-06-09
- Attribution
- Shai-Hulud worm operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud-services, open-source
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Miasma / Shai-Hulud Supply-Chain Campaign Pushes
Malware and tooling: Shai-Hulud, TruffleHog - S9009
On June 5, 2026, GitHub disabled 73 repositories across Microsoft's Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations after they were abused to push password-stealing malware as part of the self-replicating Miasma/Shai-Hulud npm/PyPI supply-chain worm. Attackers compromised a Red Hat employee's GitHub account, pivoted to Microsoft resources, injected a minimal workflow that requested GitHub OIDC tokens, and targeted developer credentials and AI coding tools (Claude Code, Gemini CLI, VS Code, Cursor). GitHub contained the incident in 105 seconds and Microsoft restored all repositories as clean.
How Miasma / Shai-Hulud Supply-Chain Campaign Pushes works
The June 5, 2026 disablement of 73 Microsoft-owned GitHub repositories is the latest wave of the Shai-Hulud self-replicating supply-chain worm (also tracked under the 'Miasma' and 'IronWorm'/'Mini Shai-Hulud' labels), a campaign that has repeatedly backdoored the npm and PyPI ecosystems since September 2025. In this wave, threat actors compromised a Red Hat employee's GitHub account and used it to pivot into Microsoft's Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations. They injected a minimal malicious GitHub Actions workflow that requested GitHub's OIDC tokens, enabling token theft and onward access. The compromise of the 'durabletask' project in May 2026 produced three malicious PyPI releases (1.4.1, 1.4.2, 1.4.3), and the 'Azure/functions-action' GitHub Action was disabled during remediation, causing deployment-workflow outages for downstream consumers.
The broader Shai-Hulud worm operates by injecting a 'preinstall' script into compromised package.json files together with two payload files, setup_bun.js (a loader that installs the Bun runtime from bun.sh/install) and bun_environment.js (a >10 MB heavily obfuscated credential stealer). Execution during the pre-install phase (rather than post-install) removes the need for human interaction and widens impact across developer workstations and CI/CD pipelines. Using the embedded TruffleHog binary and bespoke enumeration, the malware harvests credentials from the local filesystem and from cloud environments — AWS (IMDSv2, ECS metadata, SSO tokens, credential files), Google Cloud, Azure, Kubernetes, HashiCorp Vault, SSH keys, npm tokens (.npmrc), GitHub Personal Access Tokens, and crypto wallets — writing them to staging files named cloud.json, contents.json, environment.json, and truffleSecrets.json.
Stolen secrets are exfiltrated by creating public GitHub repositories (repo names matching the pattern [0-9a-z]{18}) carrying fixed descriptions such as 'Sha1-Hulud: The Second Coming' and 'Sha1-Hulud: The Continued Coming'. The worm self-propagates: using a stolen npm token it authenticates as the victim developer, enumerates that developer's other packages, injects the payload, and republishes them, spreading exponentially without operator intervention. For persistence and remote execution it registers compromised hosts as self-hosted GitHub Actions runners named SHA1HULUD and commits a malicious workflow (.github/workflows/discussion.yaml). Some variants impersonate 'Linus Torvalds' as the commit author. If credential theft fails, certain variants attempt to destroy the victim's home directory via secure overwriting, marking a shift from espionage toward sabotage. The November 24, 2025 (Shai-Hulud 2.0) wave alone backdoored roughly 700-796 unique npm packages (>20M weekly downloads) and created 25,000+ malicious repositories across ~500 GitHub users, while the May 2026 'Mini Shai-Hulud' resurgence affected 170+ npm packages and 2 PyPI packages. Microsoft Defender detects components as Trojan:JS/ShaiWorm and Behavior:Win32/SuspBunActivity.A.
MITRE ATT&CK techniques used in TL-2026-0733
Collection
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Lateral Movement
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Persistence
T1098 Account Manipulation; T1543 Create or Modify System Process
Impact
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Exfiltration
T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service
Resource Development
T1586 Compromise Accounts; T1608 Stage Capabilities
stealth
Affected products and versions in Miasma / Shai-Hulud Supply-Chain Campaign Pushes
- Microsoft — GitHub repositories (Azure, microsoft, Azure-Samples, MicrosoftDocs orgs)
Vulnerable versions: 73 repositories disabled 2026-06-05
Fixed in: restored and verified clean 2026-06-09 - Microsoft / Azure — durabletask (PyPI)
Vulnerable versions: 1.4.1; 1.4.2; 1.4.3
Fixed in: pin to pre-1.4.1 known-good release - Microsoft / Azure — Azure/functions-action (GitHub Action)
Vulnerable versions: disabled during incident
Fixed in: pin to known-good commit SHA - Red Hat — npm packages (maintainer account compromise)
Vulnerable versions: 32 Red Hat npm packages
Fixed in: republished after cleanup - npm ecosystem — Compromised npm packages (Shai-Hulud 2.0)
Vulnerable versions: @ctrl/tinycolor; @postman/tunnel-agent; posthog-node; @asyncapi/specs; @ensdomains/*; ~700-796 packages
Fixed in: maintainer-republished clean versions - PyPI ecosystem — Science-focused and other PyPI packages
Vulnerable versions: 19 science-focused PyPI packages; 2 PyPI packages (Mini Shai-Hulud)
Fixed in: removed by PyPI
Remediation for Miasma / Shai-Hulud Supply-Chain Campaign Pushes
Patches
- Update to durabletask releases superseding the malicious 1.4.x trojan versions once vendor confirms clean builds
- Re-pull all 73 restored Microsoft repositories only after confirming clean status per Microsoft advisory
Immediate actions
- Audit npm and PyPI dependencies for setup_bun.js, set_bun.js, and bun_environment.js and for any package.json containing a newly added 'preinstall' script
- Treat durabletask PyPI 1.4.1, 1.4.2 and 1.4.3 as malicious; pin to a known-good prior version and rebuild
- Rotate all developer and CI/CD credentials potentially exposed: npm tokens, GitHub PATs/OIDC tokens, AWS/GCP/Azure keys, SSH keys, and Vault tokens
- Search GitHub orgs for unexpected self-hosted runners named SHA1HULUD and for public repos with descriptions 'Sha1-Hulud: The Second Coming' / 'The Continued Coming'
- Remove malicious workflows at .github/workflows/discussion.yaml and any workflow requesting OIDC tokens that was not author-approved
Workarounds
- Set npm config ignore-scripts=true for CI installs to neutralize preinstall payload execution
- Temporarily pin Azure/functions-action and other affected GitHub Actions to a known-good commit SHA
Longer-term hardening
- Enforce least-privilege, short-lived OIDC tokens and disable persistent self-hosted runner auto-registration
- Require signed commits and 2FA/hardware keys on all maintainer accounts; restrict GitHub Actions to vetted/pinned action SHAs
- Deploy dependency-firewall / package-provenance tooling and block install-time lifecycle scripts (npm --ignore-scripts) in CI by default
- Continuously scan repos and CI logs for TruffleHog-style secret-harvesting behavior and anomalous package publishes
Weaknesses (CWE) in Miasma / Shai-Hulud Supply-Chain Campaign Pushes
CWE-506, CWE-1357, CWE-829, CWE-522, CWE-798
Timeline of Miasma / Shai-Hulud Supply-Chain Campaign Pushes
- Initial Shai-Hulud self-replicating npm worm identified, backdooring hundreds of legitimate npm packages via post-install execution (bundle.js payload).
- Shai-Hulud 2.0 ('The Second Coming') begins; earliest malicious GitHub repo creation observed at 01:22 UTC and earliest malicious npm uploads ~03:00 UTC, now using pre-install execution.
- Second phase observed (~22:45 UTC 11/25); ~700-796 npm packages backdoored, 25,000+ malicious repos across ~500 GitHub users, ~1,000 new repos every 30 minutes.
- Vendors publish IOCs and hunting queries for bun_environment.js and setup_bun.js; deduplicated sample shows 775 GitHub, 373 AWS, 300 GCP, 115 Azure credentials exposed.
- Microsoft publishes Shai-Hulud 2.0 detection/investigation guidance; Defender detections Trojan:JS/ShaiWorm and Behavior:Win32/SuspBunActivity.A added.
- 'Mini Shai-Hulud' / IronWorm resurgence affecting 170+ npm packages and 2 PyPI packages; durabletask PyPI compromised with malicious versions 1.4.1, 1.4.2, 1.4.3.
- GitHub contains the incident in 105 seconds; a compromised Red Hat employee account and an injected OIDC-token-requesting workflow identified as the pivot vector.
- GitHub disables 73 repositories across Microsoft's Azure, microsoft, Azure-Samples and MicrosoftDocs orgs after they push password-stealing malware; Azure/functions-action disabled causing deployment outages.
- Microsoft notifies a small number of customers; all 73 repositories restored and declared clean and safe to use; BleepingComputer reports the incident.
Sources cited for Miasma / Shai-Hulud Supply-Chain Campaign Pushes
- GitHub disables Microsoft repos pushing password-stealing malware
- "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack
- Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack
- The Shai-Hulud 2.0 npm worm: analysis, and what you need to know
- Shai-Hulud 2.0: Ongoing Supply Chain Attack — 25K+ Repos Exposed
- Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems
- Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading
- Shai-Hulud npm supply chain attack — new compromised packages detected
- Shai-Hulud npm supply chain attack: What you need to know
Threats related to Miasma / Shai-Hulud Supply-Chain Campaign Pushes
- npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain Worms Like Shai-Hulud
- GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks
- Malicious npm Package 'shai_hulululud' (v1.0.48596): Prompt Injection, AI-Safety Triggering, and Token Flooding to Evade AI Malware Scanners (Shai-Hulud Lineage)
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)
- Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant)
- Shai-Hulud npm Supply-Chain Worm: Two Alleged TeamPCP Members Charged by AFP/FBI
Detection coverage for TL-2026-0733
As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0733 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.