Threat reportSupply ChainTL-2026-4661
Shai-Hulud Self-Propagating Supply Chain Malware Campaign Targeting NPM, GitHub Actions and Release Pipelines
Shai-Hulud Self-Propagating Supply Chain Malware Campaign (TL-2026-4661), also tracked as Shai-Hulud, is a high-severity supply-chain compromise, first published 2026-10-28. It has no confirmed attribution, affects npm ecosystem @tanstack/* (React/Vue/Solid router and tooling, maps to 18 MITRE ATT&CK techniques (T1027, T1036.005, T1059.007), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4661
- Threat ID
- TL-2026-4661
- Also known as
- Shai-Hulud, Sha1-Hulud, Shai-Hulud 2.0, Sha1-Hulud: The Second Coming, Mini Shai-Hulud, Shai-Hulud: Here We Go Again
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, open-source maintainers, cloud services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Shai-Hulud Self-Propagating Supply Chain Malware Campaign
Malware and tooling: Shai-Hulud, TruffleHog - S9009
How Shai-Hulud Self-Propagating Supply Chain Malware Campaign works
Shai-Hulud is a self-propagating software supply chain worm that compromises npm packages, GitHub repositories and GitHub Actions release pipelines to harvest developer, CI/CD, cloud and AI-tool credentials and republish itself through every package the stolen tokens can publish. First seen in September 2025, it has recurred in at least four waves (Sep 2025, Nov 2025 'Sha1-Hulud 2.0', May 2026 'Mini Shai-Hulud' against TanStack, Aug 2026 keyv/cacheable), evolving from per-package payloads to abuse of release workflows, OIDC trusted publishing, self-hosted runners and blockchain-resolved C2.
Shai-Hulud (MITRE ATT&CK software S9008) is a supply chain worm first reported in September 2025 that spreads through code repositories such as GitHub and npm. Sygnia's incident-response write-up (2026-09-06) describes a recurring five-stage pattern: (1) compromise of an upstream maintainer through phishing or exploitation of maintainer environments and release workflows; (2) injection of malicious code into npm packages, GitHub Actions or other releases via pre- or post-install scripts; (3) harvesting of developer credentials, npm publishing keys, GitHub and GitLab tokens, CI/CD secrets, cloud, Kubernetes, Vault, SSH and SAS credentials; (4) exfiltration through a command-and-control mechanism that uses smart contract and blockchain infrastructure, which makes domain-based blocking less effective; and (5) persistence on developer workstations and through registration of additional self-hosted runners. The Sygnia article names no victims, packages or indicators; the technical detail below comes from other vendor reporting on individual waves.
September 2025 wave: post-install execution of bundle.js. Stolen secrets were exfiltrated to webhook.site endpoints and committed to public GitHub repositories named 'Shai-Hulud'. Unit 42 reports initial access through a phishing campaign spoofing npm and requesting MFA updates, and @ctrl/tinycolor was among the affected packages. Unit 42 assessed with moderate confidence that an LLM generated the malicious bash script.
November 2025 wave ('Sha1-Hulud: The Second Coming', Shai-Hulud 2.0, ~21-24 Nov 2025): execution moved to the preinstall lifecycle hook. setup_bun.js installs the Bun runtime (masquerading as a legitimate Bun installer and sidestepping Node.js-focused monitoring) and launches the heavily obfuscated bun_environment.js (10+ MB). The payload runs TruffleHog to find secrets, pulls secrets from AWS, GCP and Azure secret managers, writes cloud.json, environment.json and actionsSecrets.json and pushes them to public GitHub repositories labelled 'Sha1-Hulud: The Second Coming'. Persistence uses a self-hosted GitHub Actions runner named SHA1HULUD registered through a malicious .github/workflows/discussion.yaml, and a failsafe attempts to overwrite and delete every writable file in the user's home directory if exfiltration fails. Check Point reported 621 compromised npm packages, ~25,000 malicious repositories, 487 organizations and 14,206 leaked secrets (2,485 still valid).
May 2026 wave ('Mini Shai-Hulud', 10-11 May 2026, attributed by StepSecurity to the TeamPCP group): 42 @tanstack/* packages (84 malicious versions) plus @mistralai/mistralai, @opensearch-project/opensearch, 70+ @uipath/* packages and others were backdoored. The attacker forked TanStack/router from the account voicproducoes and added an optionalDependency '@tanstack/setup' pointing to a fork commit whose 'prepare' script runs an obfuscated Bun payload (tanstack_runner.js / router_init.js). The payload abused a pull_request_target 'Pwn Request', GitHub Actions cache poisoning and OIDC token extraction from runner process memory (/proc/<pid>/mem) to publish through the legitimate release workflow, producing valid SLSA Build Level 3 provenance. It then exchanged GitHub OIDC tokens for per-package npm publish tokens, or used npm tokens with bypass_2fa, to republish every package of the compromised maintainer. Exfiltration used the Session messenger CDN (filev2.getsession.org), a GitHub GraphQL dead-drop (commits as claude@users.noreply.github.com on dependabot/github_actions/format/* branches) and C2 at git-tanstack.com, api.masscan.cloud and 83.142.209.194. Persistence included Claude Code SessionStart hooks (.claude/settings.json), VS Code folderOpen tasks, a macOS LaunchAgent and a Linux systemd user service (gh-token-monitor) and an injected codeql_analysis.yml that exfiltrates toJSON(secrets). Upwind additionally reports a geographic kill switch keyed on Israeli and Iranian timezone/locale that runs destructive behavior, and an npm token labelled 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'.
August 2026 wave (identified 2026-08-04, JFrog): keyv@6.0.0 and cacheable@2.5.1 were the initial vectors, spreading to 400+ packages and 1,700+ versions. A preinstall loader (setup.mjs) downloads Bun 1.3.13 and runs a 710 KB obfuscated payload (math_init.js). C2 domains are resolved from the Ethereum smart contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (selector 0x53ed5143) via public RPC providers, with HTTPS on path /router; a fallback uses public GitHub repositories with Dune-themed names and the description 'Shai-Hulud: Here We Go Again'. The worm commits five persistence files (.vscode/tasks.json, .vscode/setup.mjs, .claude/math_init.js, .claude/settings.json, .claude/setup.mjs) to up to 50 branches per repository, injects codeql_analysis.yml to exfiltrate Actions secrets as artifacts, and targeted the opensearch-js release-drafter.yml workflow to publish with valid Sigstore provenance.
Attribution across waves is not established: only the May 2026 wave has been linked to a named group (TeamPCP, per StepSecurity), and Sygnia states no attribution.
MITRE ATT&CK techniques used in TL-2026-4661
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Execution
T1059.007 JavaScript; T1677 Poisoned Pipeline Execution
Persistence
T1098 Account Manipulation; T1543.002 Systemd Service; T1546.016 Installer Packages
Command and Control
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Impact
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555.006 Cloud Secrets Management Stores
Lateral Movement
T1550.001 Application Access Token
Exfiltration
T1567.001 Exfiltration to Code Repository; T1567.004 Exfiltration Over Webhook
Resource Development
Affected products and versions in Shai-Hulud Self-Propagating Supply Chain Malware Campaign
- npm ecosystem — @tanstack/* (React/Vue/Solid router and tooling packages)
Vulnerable versions: @tanstack/react-router 1.169.5, 1.169.8; @tanstack/router-core 1.169.5, 1.169.8; @tanstack/history 1.161.9, 1.161.12; 39 additional @tanstack/* packages, two malicious versions each - npm ecosystem — keyv / cacheable families
Vulnerable versions: keyv@6.0.0; cacheable@2.5.1; @keyv/*; @cacheable/* - npm ecosystem — Other compromised packages
Vulnerable versions: @mistralai/mistralai 2.2.3, 2.2.4; @opensearch-project/opensearch 3.6.2; @uipath/* (70+ packages); @ctrl/tinycolor (September 2025 wave) - GitHub — GitHub Actions workflows and self-hosted runners
Vulnerable versions: pull_request_target workflows, cache-poisonable workflows and OIDC trusted-publishing release workflows
Remediation for Shai-Hulud Self-Propagating Supply Chain Malware Campaign
Patches
- Replace compromised package versions with known-clean versions published after maintainer credentials are replaced; rebuild from trusted sources
Immediate actions
- Search lockfiles, node_modules and registries for compromised package versions and for indicator files (setup_bun.js, bun_environment.js, router_init.js, math_init.js, setup.mjs)
- Isolate affected hosts and CI runners; preserve logs and disk images before cleanup
- Revoke (do not merely rotate) npm tokens (especially bypass_2fa and write-scoped), GitHub PATs, cloud keys, Kubernetes, Vault, SSH and SAS credentials; assume exposure extends beyond initial findings
- Do not revoke an npm token labelled 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner' or 'IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients' on a live host until the host is isolated and backed up; a wipe routine is reported
- Audit GitHub for unexpected repositories ('Shai-Hulud', 'Sha1-Hulud: The Second Coming', 'Shai-Hulud: Here We Go Again', 'A Mini Shai-Hulud has Appeared'), self-hosted runners named SHA1HULUD, and workflows named discussion.yaml, shai-hulud-workflow.yml or codeql_analysis.yml that serialize secrets
- Remove persistence artifacts: .claude/settings.json SessionStart hooks, .vscode/tasks.json and setup.mjs, gh-token-monitor LaunchAgent/systemd unit, pgmonitor.py / pgsql-monitor.service
- Block and hunt for egress to git-tanstack.com, api.masscan.cloud, 83.142.209.194 and webhook.site from build environments
Workarounds
- Disable npm lifecycle scripts (npm config set ignore-scripts true) in CI where feasible
- Block execution of the Bun runtime downloads from package install steps in build environments
Longer-term hardening
- Inventory CI/CD secrets and segregate them per workflow to limit blast radius
- Pin dependencies and GitHub Actions to immutable commit SHAs rather than mutable tags
- Treat CI/CD runners as untrusted execution environments; use ephemeral runners and separate install runners from publishing runners
- Restrict OIDC token permissions and outbound network access from build environments; review npm trusted publishing and GitHub OIDC release automation
- Enforce phishing-resistant MFA on GitHub and npm; disable bypass_2fa tokens
- Apply a release cooldown (for example 10 days) before consuming newly published package versions
- Collect sufficient runner telemetry for investigation and be able to freeze critical pipelines
Weaknesses (CWE) in Shai-Hulud Self-Propagating Supply Chain Malware Campaign
Timeline of Shai-Hulud Self-Propagating Supply Chain Malware Campaign
- Shai-Hulud first reported in September 2025 (exact day not stated in sources): npm post-install worm (bundle.js) steals tokens, commits secrets to public 'Shai-Hulud' repositories and exfiltrates to webhook.site; @ctrl/tinycolor among affected packages.
- Second wave 'Sha1-Hulud: The Second Coming' (Shai-Hulud 2.0) begins (21-23 Nov per Check Point): preinstall execution of setup_bun.js / bun_environment.js, SHA1HULUD self-hosted runner persistence and a home-directory wipe failsafe.
- Security vendors publish alerts on Shai-Hulud 2.0; Check Point reports 621 compromised npm packages, ~25,000 malicious repositories, 487 affected organizations and 14,206 leaked secrets.
- GitHub account voicproducoes, later used to stage the TanStack malicious fork, is created (StepSecurity).
- Attacker creates the voicproducoes/router fork and malicious commit 79ac49eedf774dd4b0cfa308722bc463cfe5885c containing the tanstack_runner.js payload.
- Mini Shai-Hulud: 84 malicious versions across 42 @tanstack/* packages (plus @mistralai, @opensearch-project, @uipath and others) are published through the legitimate TanStack release workflow via pull_request_target abuse, cache poisoning and OIDC token theft, with valid SLSA provenance.
- JFrog identifies a new wave starting with keyv@6.0.0 and cacheable@2.5.1, spreading to 400+ packages and 1,700+ versions; C2 domains are resolved from an Ethereum smart contract.
- Sygnia publishes incident-response guidance describing the campaign's evolution from individual npm packages to compromise of the CI/CD and release infrastructure, including smart-contract/blockchain-assisted exfiltration and self-hosted runner persistence.
Sources cited for Shai-Hulud Self-Propagating Supply Chain Malware Campaign
- Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know (Sygnia)
- Shai-Hulud, Software S9008 (MITRE ATT&CK)
- "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Unit 42)
- Shai-Hulud 2.0: Inside The Second Coming (Check Point Research)
- TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)
- Shai-Hulud: Here We Go Again - TanStack Supply Chain Worm (Upwind)
- Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packages (JFrog Security Research)
- Shai-Hulud V2: npm Supply Chain Attack Analysis (Zscaler)
- Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading (Netskope)
- Shai-Hulud 2.0 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime (Endor Labs)
Detection coverage for TL-2026-4661
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4661 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4661
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.