Shai-Hulud npm Supply-Chain Worm: Two Alleged TeamPCP Members Charged by AFP/FBI
Shai-Hulud npm Supply-Chain Worm (TL-2026-2186), also tracked as Shai-Hulud, is a critical-severity supply-chain compromise, first published 2026-08-28. It is attributed to TeamPCP with high confidence, affects npm, Inc. npm package registry ecosystem, maps to 13 MITRE ATT&CK techniques (T1005, T1036, T1059.007), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2186
- Threat ID
- TL-2026-2186
- Also known as
- Shai-Hulud, Sha1-Hulud, Sha1-Hulud: The Second Coming, Mini Shai-Hulud
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-28
- Last reviewed
- 2026-08-28
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cloud services, artificial intelligence, telecoms, cybersecurity vendors, open source ecosystem
- Target regions
- Global, North America, Europe, Asia-Pacific, Oceania
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Shai-Hulud npm Supply-Chain Worm
Malware and tooling: Python, Sha1-Hulud: The Second Coming, Shai-Hulud, TruffleHog - S9009
The Australian Federal Police and FBI charged two Western Australian men, Louis Michael Gaebler (23) and Ruben Ian Thomson (21), over their alleged roles in TeamPCP, the cybercrime syndicate behind the self-propagating "Shai-Hulud" npm supply-chain worm. Since first appearing in September 2025, successive worm waves (Shai-Hulud, "Sha1-Hulud: The Second Coming," and a May/August 2026 "Mini Shai-Hulud" resurgence) have compromised hundreds of npm/PyPI/GitHub Actions packages, harvested 500,000+ credentials, and exfiltrated at least 300GB of data from over 1,000 organizations, including OpenAI, GitHub, LiteLLM, Aqua Trivy, Checkmarx KICS, and TanStack.
How Shai-Hulud npm Supply-Chain Worm works
Shai-Hulud is a self-propagating software supply-chain worm first documented by security researchers (including ReversingLabs) on 15 September 2025, when trojanized versions of @ctrl/tinycolor and dozens of other npm packages began shipping a malicious postinstall script (bundle.js). On execution, bundle.js downloaded and ran TruffleHog — a legitimate open-source secret-scanning tool — to sweep the host filesystem and cloud instance-metadata endpoints (AWS/GCP/Azure) for npm tokens, GitHub credentials, SSH keys, and other secrets, then published the harvested material to public GitHub repositories described as "Shai-Hulud" and to a webhook.site endpoint. Where the harvested secrets included additional valid npm publish tokens, the worm automatically republished trojanized versions of every package reachable by that token, turning each new infection into a fresh propagation vector without further attacker interaction. CISA issued an alert on the widespread compromise on 23 September 2025.
A second wave, "Sha1-Hulud: The Second Coming," surfaced in November 2025, compromising 700+ npm packages and creating more than 27,000 attacker-controlled GitHub repositories; this version added a self-hosted GitHub Actions runner and a malicious workflow (triggered on the `discussion` event) that executed attacker-supplied shell commands via `${{ github.event.discussion.body }}`, giving the worm a lightweight, registry-independent command channel. The syndicate behind the campaign, later attributed by the AFP/FBI as "TeamPCP," expanded operations across npm, PyPI, Docker Hub, GitHub Actions, and OpenVSX, backdooring projects including the Trivy vulnerability scanner (Aqua Security), the KICS IaC scanner (Checkmarx), and the LiteLLM AI gateway; CloudSEK reported 78,330 secrets exfiltrated from 2,186 organizations' CI/CD pipelines in a single five-day window in March 2026, and Aikido separately reported LiteLLM-linked secrets harvested from 434,000 CI/CD pipelines across 2,500+ organizations. A "Mini Shai-Hulud" resurgence in May 2026 compromised 160+ packages in roughly 24 hours, including 42 packages in the @tanstack/* scope — notably @tanstack/react-router, which has 12M+ weekly downloads — and coincided with confirmed data theft from OpenAI. A further wave on 4 August 2026 compromised 400+ npm packages, including keyv and cacheable, three weeks before the arrests.
On 26 August 2026, the AFP, FBI, and Western Australia Police Force charged Louis Michael Gaebler (23, of Mandurah) with six computer-crime offences and Ruben Ian Thomson (21, of Cottesloe) with eight offences including unauthorised data modification, supplying/possessing data with intent to commit a computer offence, failing to comply with a section 3LA order, and dealing with proceeds of crime exceeding AUD $100,000. Thomson is alleged to have led TeamPCP under the handle "Ellis" until stepping back from active leadership around March 2026. Both appeared at Perth Magistrates Court on 27 August 2026 after AFP searches of properties in Cottesloe, Hamilton Hill, and Mandurah. The AFP attributes over 1,000 compromised organisations, 500,000+ stolen credentials, and at least 300GB of exfiltrated data to the syndicate, with global remediation costs estimated in the hundreds of millions of dollars. Analysts caution the arrests do not close the underlying supply-chain exposure: TeamPCP's worm source code has reportedly circulated on cybercrime forums, and organizations that have ever installed an affected package remain at risk from previously exfiltrated credentials.
MITRE ATT&CK techniques used in TL-2026-2186
Collection
Defense Evasion
Execution
T1059.007 Command and Scripting Interpreter: JavaScript
Persistence
Initial Access
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
initial-access
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API
Exfiltration
T1567 Exfiltration Over Web Service; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Resource Development
T1583.006 Acquire Infrastructure: Web Services; T1588.002 Obtain Capabilities: Tool
Affected products and versions in Shai-Hulud npm Supply-Chain Worm
- npm, Inc. — npm package registry ecosystem
Vulnerable versions: backdoored package versions published across the Sept 2025 - Aug 2026 campaign waves
Fixed in: package-by-package maintainer-republished clean versions - TanStack — @tanstack/react-router and the @tanstack/* npm scope
Vulnerable versions: ~84 malicious versions published in the May 2026 'Mini Shai-Hulud' wave across 42 @tanstack packages
Fixed in: maintainer-republished clean versions post-May-2026 - Aqua Security — Trivy GitHub Action
Vulnerable versions: backdoored release in the March 2026 TeamPCP wave
Fixed in: remediated release post-disclosure - Checkmarx — KICS GitHub Action
Vulnerable versions: backdoored release in the March 2026 TeamPCP wave
Fixed in: remediated release post-disclosure - BerriAI — LiteLLM (PyPI)
Vulnerable versions: backdoored release in the March 2026 TeamPCP wave
Fixed in: remediated release post-disclosure - npm community — keyv / cacheable
Vulnerable versions: malicious versions published 4 August 2026
Fixed in: maintainer-republished clean versions
Remediation for Shai-Hulud npm Supply-Chain Worm
Patches
- Update to maintainer-republished clean versions of any package confirmed compromised in the Sept 2025, Nov 2025, Mar 2026, May 2026, or Aug 2026 waves
Immediate actions
- Audit npm/CI build logs and package-lock diffs for lifecycle-script (preinstall/postinstall/prepare) changes introduced between package versions across the Sept 2025 - Aug 2026 campaign window
- Rotate all npm, GitHub, and cloud-provider (AWS/GCP/Azure) tokens and credentials on any system that ever installed a package from an affected scope, including build agents and self-hosted CI/CD runners
- Search organization-owned and forked GitHub namespaces for unexpected public repositories, branches, or self-hosted runners referencing 'Shai-Hulud' or 'Sha1-Hulud', or matching the [0-9a-z]{18} exfiltration-repo naming pattern
- Block or alert on outbound CI/CD build-agent traffic to webhook.site and other ad-hoc webhook/paste services
Workarounds
- Pin to pre-compromise package versions and disable automatic dependency updates until a package's clean status is confirmed
- Run `npm install --ignore-scripts` in CI/CD pipelines where lifecycle scripts are not required
Longer-term hardening
- Pin npm/PyPI dependencies to specific audited versions and enforce lockfile integrity verification in CI
- Deploy software-composition-analysis tooling that flags lifecycle-script diffs and unexpected external binary downloads (curl/wget/fetch to non-registry domains) during package install
- Require least-privilege, short-lived npm/GitHub publish tokens; disable self-hosted GitHub Actions runners triggered by untrusted event types such as 'discussion' or 'issue_comment'
- Adopt package provenance/attestation (npm provenance, Sigstore) for internally published packages and verify provenance on third-party dependencies
Weaknesses (CWE) in Shai-Hulud npm Supply-Chain Worm
CWE-506, CWE-1357
Timeline of Shai-Hulud npm Supply-Chain Worm
- Original Shai-Hulud worm first identified in the wild after trojanized versions of @ctrl/tinycolor and dozens of other npm packages begin shipping a malicious postinstall script (bundle.js).
- CISA issues an alert on the widespread supply-chain compromise impacting the npm ecosystem.
- "Sha1-Hulud: The Second Coming" wave detected, compromising 700+ npm packages and spawning 27,000+ attacker-controlled GitHub repositories, and adding a self-hosted GitHub Actions runner RCE via the 'discussion' workflow trigger.
- TeamPCP backdoors cross-ecosystem developer tooling including Trivy (Aqua Security), KICS (Checkmarx), and LiteLLM; CloudSEK reports 78,330 secrets exfiltrated from 2,186 organizations' CI/CD pipelines in a five-day window.
- Alleged TeamPCP leader Ruben Thomson (operating under the handle 'Ellis') reportedly steps back from active leadership of the syndicate.
- "Mini Shai-Hulud" wave compromises 160+ npm packages in roughly 24 hours, including 42 packages in the @tanstack/* scope (notably @tanstack/react-router, 12M+ weekly downloads); OpenAI subsequently confirms data theft tied to the wave.
- New campaign wave compromises 400+ npm packages, including keyv and cacheable.
- AFP, FBI, and Western Australia Police Force charge Louis Michael Gaebler (23, Mandurah) and Ruben Ian Thomson (21, Cottesloe) with computer-crime offences tied to TeamPCP after searches in Cottesloe, Hamilton Hill, and Mandurah.
- Gaebler and Thomson appear at Perth Magistrates Court.
- ReversingLabs publishes a retrospective analysis of the arrests and the Shai-Hulud campaign's scale and persistence risk.
Sources cited for Shai-Hulud npm Supply-Chain Worm
- Shai-Hulud worm arrests: What you need to know
- Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
- Two alleged TeamPCP hackers arrested over global supply chain attacks
- Shai-Hulud hackers: two men charged over TeamPCP's global supply chain crime spree that hit OpenAI, and thousands more
- Australian Arrests Allegedly Disrupt TeamPCP, but the Shai-Hulud Threat Persists
- 500+ npm Packages Compromised in Ongoing Supply Chain Attack 'Shai-Hulud'
- Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
- FBI: TeamPCP Compromised Dev Tools to Steal Cloud Credentials
- Australian cops cuff alleged TeamPCP masterminds
- TeamPCP arrests don't fix the supply chain risk they exposed
- Widespread Supply Chain Compromise Impacting npm Ecosystem
- Shai-Hulud npm Supply Chain Attack
- The Shai-Hulud 2.0 npm worm: analysis, and what you need to know
- Sha1-Hulud / Shai-Hulud: Full Technical Dissection of TeamPCP's Self-Propagating Supply Chain Worm
More in supply chain
- GemStuffer: AI Agent Swarm Floods RubyGems With 2,000+ Malicious Packages, Achieves RCE via RubyDoc.info Build System, Attempts API Key Theft
- OpenAI Agent Swarm ("GemStuffer") Flooded RubyGems With 2,000+ Malicious Packages, Achieved RCE on RubyDoc.info Build Servers
- GemStuffer: OpenAI Autonomous Agents Flood RubyGems With 2,000+ Malicious Packages, Abuse RubyDoc.info Build System for RCE and Target a RubyGems API-Key Cache-Leak Flaw
- Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool Hijack (GHSA-vx42-ghc9-gw65)
- Slopsquatting: Attackers Weaponize AI-Hallucinated Package Names in Supply Chain Attacks
Detection coverage for TL-2026-2186
As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2186 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.