Threat reportSupply ChainTL-2026-4090
Credential Layer Exposure: Secrets Sprawl and Shai-Hulud npm Supply Chain Credential Harvesting (GitGuardian)
Credential Layer Exposure (TL-2026-4090), also tracked as Shai-Hulud, is a medium-severity supply-chain compromise, first published 2026-10-22 and last reviewed 2026-10-23. It has no confirmed attribution, affects npm (OpenJS/GitHub) npm packages compromised by the Shai-Hulud worm, maps to 16 MITRE ATT&CK techniques (T1020, T1027, T1059.004), and is covered by 9 detection rules and 38 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 38Indicators of compromise
Key facts for TL-2026-4090
- Threat ID
- TL-2026-4090
- Also known as
- Shai-Hulud, Shai-Hulud 2.0, Sha1-Hulud: The Second Coming, Secrets Sprawl, Credential Layer Exposure
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, finance, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 38
- Updates
- 2026-10-23 · revalidated 1× · latest source
Malware and tooling in Credential Layer Exposure
Malware and tooling: Shai-Hulud, Shai-Hulud 2.0, Bun, TruffleHog - S9009
How Credential Layer Exposure works
GitGuardian reports 28.65 million new secrets exposed on public GitHub in 2025 (+34% YoY), with about 28% of secret incidents occurring outside code repositories and developer laptops holding roughly 150 secrets each. The Shai-Hulud npm worm waves (September and November 2025) turned developer and CI environments into credential-harvesting points. GitGuardian's analysis of Shai-Hulud 2.0 found 33,185 unique secrets across 294,842 occurrences, with 3,760 confirmed valid.
This record documents the credential-layer exposure picture from GitGuardian's 2026 reporting (blog post of 2026-10-21, 'What Is Credential Layer Security?') and the Shai-Hulud supply chain worm it cites as its main case study. The blog is a vendor thought-leadership piece, not a primary DFIR report. It states no CVEs, no threat-actor attribution and no IOCs. The technical detail below comes from primary and secondary reporting on the Shai-Hulud campaigns.
Secrets sprawl statistics (GitGuardian, State of Secrets Sprawl 2026): 28.65 million new secrets were exposed on public GitHub during 2025 (+34% year over year). About 28% of secret incidents occurred outside code repositories. Developer laptops hold about 150 secrets each on average. The blog also cites 24,008 unique secrets in publicly exposed MCP (Model Context Protocol) configuration files, 2,117 of them valid, and an 81% year-over-year rise in AI-service credentials.
Shai-Hulud wave 1 (identified 2025-09-14/15): a self-replicating worm hidden in trojanized npm packages. Over 180 packages were initially reported (including tinycolor), later over 500 per CISA. Malicious code ran bundle.js, which downloaded and ran the legitimate TruffleHog scanner to find GitHub PATs, npm tokens and AWS/GCP/Azure keys. Findings were exfiltrated to a webhook.site endpoint and published to public repositories named 'Shai-Hulud' created through the GitHub /user/repos API. The worm injected the workflow .github/workflows/shai-hulud-workflow.yml and used stolen npm tokens to republish further packages with injected code. CISA published alert guidance on 2025-09-23 recommending dependency review, pinning to versions produced before 2025-09-16, credential rotation, phishing-resistant MFA, and blocking webhook.site.
Shai-Hulud 2.0 'The Second Coming' (prepared from 2025-11-21, launched 2025-11-24): the payload moved to the npm preinstall step using setup_bun.js, which installs the Bun runtime, and bun_environment.js, which holds the core logic. Bun runs outside many detection paths. TruffleHog ran from /home/runner/.truffler-cache/trufflehog with a filesystem sweep of /home/runner. Cloud metadata endpoints and cloud secret managers (AWS, GCP, Azure) were queried with stolen tokens. Instead of a public endpoint, exfiltration used GitHub repositories created with victim credentials. These carried the description 'Sha1-Hulud: The Second Coming' and randomly generated 18-character names. They held cloud.json, environment.json and actionsSecrets.json. Persistence came from registering infected hosts as self-hosted GitHub runners (a discussion-triggered backdoor workflow) and from injecting rogue workflows that serialize repository secrets into CI artifacts, then deleting them. Check Point reports a destructive failsafe that wipes local files when containment is detected. Reported scale is 754 packages (1,700 versions) per GitGuardian, 621 per Check Point, and about 25,000 repositories. GitGuardian's headline analysis found 14,206 secrets across 487 organizations (2,485 still valid), and its broader post-processed dataset has 33,185 unique secrets across 294,842 occurrences, with 3,760 valid (about 11%). GitHub credentials dominated the valid secrets: 581 PATs, 386 OAuth tokens, 104 fine-grained PATs and 101 GitLab tokens. GitGuardian notes the true valid count at leak time was likely higher because many credentials were rotated before validation.
Note on the PyPI claim: the hunt summary and blog tie Shai-Hulud to npm/PyPI. The sourced Shai-Hulud 2.0 figures (754 packages, 20,649 repositories) are npm-based. GitGuardian's separate PyPI research (3,938 unique secrets, 768 valid) is a distinct, earlier study of secrets leaked in PyPI packages and not part of the Shai-Hulud worm.
Defensive takeaway: treat developer endpoints, CI runners, AI-tool/MCP configuration and package install hooks as one credential layer. Prefer short-lived, scoped credentials, disable install scripts where possible, pin dependencies, and monitor GitHub for unexpected repository creation, self-hosted runner registration and new workflows. Severity and status are analyst-assigned, not source-stated.
MITRE ATT&CK techniques used in TL-2026-4090
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.004 Command and Scripting Interpreter; T1059.007 JavaScript
Persistence
Command and Control
Collection
Initial Access
T1195.002 Compromise Software Supply Chain; T1566.002 Phishing
Impact
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.004 Unsecured Credentials; T1552.005 Cloud Instance Metadata API; T1555.006 Credentials from Password Stores
Affected products and versions in Credential Layer Exposure
- npm (OpenJS/GitHub) — npm packages compromised by the Shai-Hulud worm (e.g. tinycolor, ENS Domains, Zapier, PostHog and Voiceflow packages)
Vulnerable versions: Compromised package versions published during 2025-09 and 2025-11 waves
Fixed in: Versions published before 2025-09-16 (wave 1 per CISA); consult vendor advisories for wave 2 - GitHub — GitHub repositories, Actions workflows and self-hosted runners abused for exfiltration and persistence
Vulnerable versions: Environments with exposed PATs/OAuth tokens
Fixed in: Rotate credentials and audit runners/workflows
Remediation for Credential Layer Exposure
Immediate actions
- Rotate all developer, CI/CD, GitHub, npm and cloud credentials that were present on any host that installed affected packages
- Search GitHub organizations for repositories named 'Shai-Hulud' or described 'Sha1-Hulud: The Second Coming', for unexpected self-hosted runners, and for unrecognized workflows such as shai-hulud-workflow.yml
- Block outbound connections to webhook.site and review firewall/proxy logs for it
- Audit package-lock.json and yarn.lock, including nested dependencies, for compromised package versions
Workarounds
- Pin npm dependencies to releases produced before 2025-09-16 for wave 1, per CISA
- Remove unneeded GitHub Apps and OAuth applications and audit repository webhooks and secrets
Longer-term hardening
- Enforce phishing-resistant MFA on GitHub and npm accounts
- Prefer short-lived, scoped credentials and workload identity over static secrets in CI
- Run secret scanning on developer endpoints, CI logs, collaboration tools and MCP/AI-agent configuration files, not only on code repositories
- Disable npm lifecycle scripts (ignore-scripts) in CI where feasible and use dependency cooldown or pinning policies
- Enable branch protection, GitHub secret scanning and Dependabot security updates
Weaknesses (CWE) in Credential Layer Exposure
Timeline of Credential Layer Exposure
- Shai-Hulud, a self-replicating npm worm, is identified; over 180 packages (including tinycolor) are initially reported compromised
- Original Shai-Hulud wave: npm packages compromised on or before this date (CISA advises pinning to versions published before 2025-09-16)
- Blackpoint Cyber and others publish technical analysis: bundle.js runs TruffleHog, exfiltrates to webhook.site and injects shai-hulud-workflow.yml; over 700 'Shai-Hulud' repositories created under victim accounts
- CISA publishes an alert on the npm compromise (over 500 packages), recommending dependency review, credential rotation, phishing-resistant MFA and blocking webhook.site
- Preparation of the second wave begins, per GitGuardian
- Last Shai-Hulud 2.0 affected package published around 18:00 UTC; npm likely implemented preventive measures (Datadog)
- Shai-Hulud 2.0 ('The Second Coming') launches using preinstall setup_bun.js and bun_environment.js, with GitHub repositories as dead-drops; security vendors publish alerts the same day
- Unit 42 updates its report with Shai-Hulud 2.0 details: over 25,000 malicious repositories across about 350 unique users
- 754 unique npm packages (1,700 versions) are reported infected; GitGuardian publishes analysis of exposed secrets
- PostHog publishes an incident postmortem on its Shai-Hulud 2.0 compromise (per Datadog)
- GitGuardian publishes 'What Is Credential Layer Security?' citing 28.65M secrets exposed on public GitHub in 2025 and the Shai-Hulud 2.0 data (33,185 unique secrets, 294,842 occurrences, 3,760 valid)
Update history for TL-2026-4090
- 2026-10-23 — Software Supply Chain Risk for Fintechs: Inherited Container Image Vulnerabilities and the Shai-Hulud / Shai-Hulud 2.0 npm Worm Campaigns: What changed No severity, exploitability or status change: the report gives no new evidence of escalation (exploitability is already ACTIVE; severity is analyst-assigned). Intelligence is enriched only. New indicators (15) 15 new IOCs: 6 wa
Sources cited for Credential Layer Exposure
- What Is Credential Layer Security? The Layer Every Other Control Trusts (GitGuardian)
- Widespread Supply Chain Compromise Impacting npm Ecosystem (CISA)
- Inside the Shai-Hulud NPM Supply Chain Attack (Blackpoint Cyber)
- Shai-Hulud 2.0: Inside The Second Coming, the Most Aggressive NPM Supply Chain Attack of 2025 (Check Point)
- Shai Hulud 2.0: The NPM Supply Chain Attack Returns as an Aggressive Self-Propagating Worm (Upwind)
- Shai-Hulud 2.0: Over 14,000 Secrets Exposed (GitGuardian via Security Boulevard)
- Uncovering Thousands of Unique Secrets in PyPI Packages (GitGuardian)
- CISA urges orgs to review software after 'Shai-Hulud' supply chain compromise (The Record)
- Shai-Hulud Worm Prowls npm to Steal Hundreds of Secrets (Infosecurity Magazine)
- Shai-Hulud 2.0 Deep Dive and Actionable Steps You Should Take (Cycode)
Detection coverage for TL-2026-4090
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4090 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.