The Shai-Hulud Worm Hits 187 npm Packages
Security researchers have identified at least 187 npm packages compromised in an ongoing self-propagating supply chain attack dubbed "Shai-Hulud." The campaign kicked off with the breach of @ctrl/tinycolor, a package with over two million weekly downloads, and rapidly expanded to include projects published under CrowdStrike's npm namespace. What makes this intrusion stand out is its worm-like ability to automatically infect other packages maintained by the same account, creating a cascading compromise across the npm registry.
How the Self-Propagating Malware Works
The attack chain begins when a developer installs a compromised version of an affected package. Inside, a minified Webpack-bundled script named bundle.js executes asynchronously, likely triggered through a hijacked postinstall hook in package.json. This script contains six core modules that handle everything from system reconnaissance to credential theft and automatic propagation.
The self-propagation engine queries the NPM registry API to fetch up to 20 packages owned by the maintainer, then force-publishes patched versions. This means a single compromised maintainer account can seed malicious updates across dozens of downstream packages in a single wave. The malware validates NPM tokens via the /whoami endpoint before issuing search queries for /v1/search?text=maintainer:${username}&size=20, pulling in every package the maintainer publishes.
Credential Harvesting Across Cloud Platforms
Once running, the malware pulls the entire process.env, capturing transient tokens such as GITHUB_TOKEN and AWS_ACCESS_KEY_ID. It then uses TruffleHog to scan the filesystem for high-entropy secrets, searching for patterns like AKIA[0-9A-Z]{16} that indicate AWS access keys. Beyond local scanning, the malware enumerates AWS Secrets Manager using SDK pagination and accesses Google Cloud Platform secrets via the @google-cloud/secret-manager API. Azure credentials are also targeted through similar SDK calls.
The harvested credentials feed into a large JSON payload that gets exfiltrated to a hardcoded webhook endpoint (hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7). Socket researchers Kush Pandya and Peter van der Zee confirmed that the malware validates and uses developer and CI credentials, creates GitHub Actions workflows inside repositories, and ships exfiltrated data to that webhook.
GitHub Backdoor and Persistence
The malware establishes persistence by injecting a GitHub Actions workflow file (.github/workflows/shai-hulud-workflow.yml) via a base64-encoded bash script. This workflow triggers on push events and exfiltrates all repository secrets using the ${{ toJSON(secrets) }} expression to the same C2 webhook. The script also creates a malicious branch named shai-hulud by force-merging from the default branch via GitHub's /git/refs endpoint, ensuring the backdoor survives repository cleanup attempts.
After the compromised package creates a commit containing the workflow, the backdoor executes immediately, harvesting every secret the repository has access to. The exfiltrated data ends up in a public GitHub repository named "Shai-Hulud," which researchers can search for using GitHub's code search. This pattern of using public GitHub repositories as exfiltration endpoints blends into normal developer activity and bypasses many traditional security controls.
The Affected Package List
The StepSecurity analysis maintained an extensive list of compromised packages, starting with @ctrl/tinycolor versions 4.1.1 and 4.1.2 and spreading across namespaces including @ahmedhfarag, @art-ws, @crowdstrike, @ctrl, @hestjs, @nativescript-community, @operato, @pesticman, @sst, @thangved, @teselagen, @things-factory, @tnf-dev, @ui-ux-gang, @yoobic, and more. The CrowdStrike spokesperson told BleepingComputer that the removed packages are not used in the Falcon sensor and that customers remain protected, but the incident underscores how even well-resourced security vendors can fall victim to supply chain attacks.
Immediate Response Steps
Security researchers recommend several urgent actions for anyone using affected packages:
- Check for @ctrl/tinycolor in your dependency tree with
npm ls @ctrl/tinycolorand uninstall compromised versions immediately. - Remove the malicious GitHub Actions workflow:
rm -f .github/workflows/shai-hulud-workflow.yml. - Look for suspicious "shai-hulud" branches across all repositories and delete them with
git push origin --delete shai-hulud. - Rotate all NPM tokens, GitHub personal access tokens, and CI/CD secrets.
- Audit cloud infrastructure for unauthorized secret access, particularly AWS CloudTrail events for BatchGetSecretValue, ListSecrets, and GetSecretValue calls.
- Block outbound connections to webhook.site domains and monitor firewall logs for connections to the C2 endpoint.
Vendor Responses
CrowdStrike confirmed it removed the malicious packages and rotated keys in public registries, emphasizing that the packages are not used in the Falcon sensor and that the platform itself remains protected. The npm security team and package maintainers responded swiftly, though the collaborative nature of the response— involving researchers at Socket, Aikido, and StepSecurity— highlights how dependent the ecosystem is on voluntary information sharing.
Google's Gemini CLI team issued a statement clarifying that the source code itself was not compromised, but users who installed or updated the CLI during the attack window via NPM may be affected. The incident follows other large-scale supply chain attacks in the same month, including the "s1ngularity" campaign that hit 2,180 GitHub accounts and a separate phishing attack on maintainers of the chalk and debug npm packages.
Ongoing Monitoring and Prevention
Developers are advised to pin dependencies to trusted releases, limit the scope of publishing credentials, and set up alerts for any new npm publishes from their organizations. Tools like StepSecurity Harden-Runner can detect anomalous network calls during CI/CD runs, and the StepSecurity Threat Center provides real-time supply chain threat intelligence including indicators of compromise and remediation guidance. Implementing a short npm package cooldown period— defaulting to two days— can reduce exposure to fresh attacks, since most supply chain compromises are detected within the first 24 hours of a malicious release.
The Shai-Hulud campaign represents a concerning evolution in open-source supply chain threats: a self-replicating worm that doesn't just steal credentials but automatically spreads to every package a maintainer publishes. As the ecosystem digests the scope of 187+ compromised packages, the urgency to adopt stronger dependency provenance and runtime security monitoring has never been clearer.
This article draws on reporting from BleepingComputer (Sept 16, 2025) and the technical analysis published by StepSecurity. All factual claims remain traceable to the verified source references associated with this task.