# Shai-Hulud Self-Propagating Supply Chain Malware Campaign Targeting NPM, GitHub Actions and Release Pipelines

> Shai-Hulud is a self-propagating software supply chain worm that compromises npm packages, GitHub repositories and GitHub Actions release pipelines to harvest developer, CI/CD, cloud and AI-tool credentials and republish itself through every package the stolen tokens can publish. First seen in September 2025, it has recurred in at least four waves (Sep 2025, Nov 2025 'Sha1-Hulud 2.0', May 2026 'Mini Shai-Hulud' against TanStack, Aug 2026 keyv/cacheable), evolving from per-package payloads to abuse of release workflows, OIDC trusted publishing, self-hosted runners and blockchain-resolved C2.

- **Published:** 2026-10-28T17:40:29Z
- **Last reviewed:** 2026-10-28T17:40:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4661
- **ID:** TL-2026-4661
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Shai-Hulud (MITRE ATT&CK software S9008) is a supply chain worm first reported in September 2025 that spreads through code repositories such as GitHub and npm. Sygnia's incident-response write-up (2026-09-06) describes a recurring five-stage pattern: (1) compromise of an upstream maintainer through phishing or exploitation of maintainer environments and release workflows; (2) injection of malicious code into npm packages, GitHub Actions or other releases via pre- or post-install scripts; (3) harvesting of developer credentials, npm publishing keys, GitHub and GitLab tokens, CI/CD secrets, cloud, Kubernetes, Vault, SSH and SAS credentials; (4) exfiltration through a command-and-control mechanism that uses smart contract and blockchain infrastructure, which makes domain-based blocking less effective; and (5) persistence on developer workstations and through registration of additional self-hosted runners. The Sygnia article names no victims, packages or indicators; the technical detail below comes from other vendor reporting on individual waves.

September 2025 wave: post-install execution of bundle.js. Stolen secrets were exfiltrated to webhook.site endpoints and committed to public GitHub repositories named 'Shai-Hulud'. Unit 42 reports initial access through a phishing campaign spoofing npm and requesting MFA updates, and @ctrl/tinycolor was among the affected packages. Unit 42 assessed with moderate confidence that an LLM generated the malicious bash script.

November 2025 wave ('Sha1-Hulud: The Second Coming', Shai-Hulud 2.0, ~21-24 Nov 2025): execution moved to the preinstall lifecycle hook. setup_bun.js installs the Bun runtime (masquerading as a legitimate Bun installer and sidestepping Node.js-focused monitoring) and launches the heavily obfuscated bun_environment.js (10+ MB). The payload runs TruffleHog to find secrets, pulls secrets from AWS, GCP and Azure secret managers, writes cloud.json, environment.json and actionsSecrets.json and pushes them to public GitHub repositories labelled 'Sha1-Hulud: The Second Coming'. Persistence uses a self-hosted GitHub Actions runner named SHA1HULUD registered through a malicious .github/workflows/discussion.yaml, and a failsafe attempts to overwrite and delete every writable file in the user's home directory if exfiltration fails. Check Point reported 621 compromised npm packages, ~25,000 malicious repositories, 487 organizations and 14,206 leaked secrets (2,485 still valid).

May 2026 wave ('Mini Shai-Hulud', 10-11 May 2026, attributed by StepSecurity to the TeamPCP group): 42 @tanstack/* packages (84 malicious versions) plus @mistralai/mistralai, @opensearch-project/opensearch, 70+ @uipath/* packages and others were backdoored. The attacker forked TanStack/router from the account voicproducoes and added an optionalDependency '@tanstack/setup' pointing to a fork commit whose 'prepare' script runs an obfuscated Bun payload (tanstack_runner.js / router_init.js). The payload abused a pull_request_target 'Pwn Request', GitHub Actions cache poisoning and OIDC token extraction from runner process memory (/proc/<pid>/mem) to publish through the legitimate release workflow, producing valid SLSA Build Level 3 provenance. It then exchanged GitHub OIDC tokens for per-package npm publish tokens, or used npm tokens with bypass_2fa, to republish every package of the compromised maintainer. Exfiltration used the Session messenger CDN (filev2.getsession.org), a GitHub GraphQL dead-drop (commits as claude@users.noreply.github.com on dependabot/github_actions/format/* branches) and C2 at git-tanstack.com, api.masscan.cloud and 83.142.209.194. Persistence included Claude Code SessionStart hooks (.claude/settings.json), VS Code folderOpen tasks, a macOS LaunchAgent and a Linux systemd user service (gh-token-monitor) and an injected codeql_analysis.yml that exfiltrates toJSON(secrets). Upwind additionally reports a geographic kill switch keyed on Israeli and Iranian timezone/locale that runs destructive behavior, and an npm token labelled 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'.

August 2026 wave (identified 2026-08-04, JFrog): keyv@6.0.0 and cacheable@2.5.1 were the initial vectors, spreading to 400+ packages and 1,700+ versions. A preinstall loader (setup.mjs) downloads Bun 1.3.13 and runs a 710 KB obfuscated payload (math_init.js). C2 domains are resolved from the Ethereum smart contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (selector 0x53ed5143) via public RPC providers, with HTTPS on path /router; a fallback uses public GitHub repositories with Dune-themed names and the description 'Shai-Hulud: Here We Go Again'. The worm commits five persistence files (.vscode/tasks.json, .vscode/setup.mjs, .claude/math_init.js, .claude/settings.json, .claude/setup.mjs) to up to 50 branches per repository, injects codeql_analysis.yml to exfiltrate Actions secrets as artifacts, and targeted the opensearch-js release-drafter.yml workflow to publish with valid Sigstore provenance.

Attribution across waves is not established: only the May 2026 wave has been linked to a named group (TeamPCP, per StepSecurity), and Sygnia states no attribution.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1608.001 Upload Malware
- T1059.007 JavaScript
- T1677 Poisoned Pipeline Execution
- T1546.016 Installer Packages
- T1543.002 Systemd Service
- T1098 Account Manipulation
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1555.006 Cloud Secrets Management Stores
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1102.001 Dead Drop Resolver
- T1567.001 Exfiltration to Code Repository
- T1567.004 Exfiltration Over Webhook
- T1485 Data Destruction

## Sources

- [Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know (Sygnia)](https://www.sygnia.co/blog/shai-hulud-in-the-wild-what-security-and-incident-response-teams-need-to-know/)
- [Shai-Hulud, Software S9008 (MITRE ATT&CK)](https://attack.mitre.org/software/S9008/)
- ["Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Unit 42)](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/)
- [Shai-Hulud 2.0: Inside The Second Coming (Check Point Research)](https://blog.checkpoint.com/research/shai-hulud-2-0-inside-the-second-coming-the-most-aggressive-npm-supply-chain-attack-of-2025/)
- [TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages (StepSecurity)](https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem)
- [Shai-Hulud: Here We Go Again - TanStack Supply Chain Worm (Upwind)](https://www.upwind.io/feed/shai-hulud-tanstack-supply-chain-worm)
- [Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packages (JFrog Security Research)](https://research.jfrog.com/post/shai-hulud-is-back-august/)
- [Shai-Hulud V2: npm Supply Chain Attack Analysis (Zscaler)](https://www.zscaler.com/blogs/security-research/shai-hulud-v2-poses-risk-npm-supply-chain)
- [Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading (Netskope)](https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed)
- [Shai-Hulud 2.0 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime (Endor Labs)](https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4661