Dead Man’s Switch: Widespread npm Supply Chain Attack Driving Malware Attacks

A severe and ongoing supply chain attack is currently sending shockwaves through the developer community after GitLab’s security team uncovered malware spreading via npm, the world’s most extensive software code library.

At the heart of this campaign is a destructive new malware known as Shai-Hulud, which leverages a highly dangerous “dead man’s switch” a self-destruct mechanism that threatens to wipe user data if defenders succeed in disrupting the attack.

Security researchers have identified numerous npm packages laced with Shai-Hulud. Unlike most malware, which typically requires user interaction to spread, Shai-Hulud behaves like a worm.

Once it compromises a developer’s machine, it automatically attempts to infect other npm packages maintained by that developer.

The result is an increase in risk, as each infected package may then target new developers and teams.

The attack begins when a developer installs a seemingly legitimate npm package. An installation script, setup_bun.js, is automatically executed.

While this script claims to install Bun—a real programming tool—it actually launches malicious code hidden within a massive, highly obfuscated file.

Upon activation, Shai-Hulud scans the victim’s computer for secrets such as GitHub tokens, Amazon and Microsoft cloud credentials, and npm publication passwords.

To maximize its reach, the malware downloads a security scanner, allowing it to trawl through files and git history for sensitive API keys.

Stolen credentials are uploaded to special GitHub repositories labeled “Sha1-Hulud: The Second Coming,” functioning as secure criminal storage.

Shai-Hulud then uses these stolen npm credentials to inject its malicious code into every package managed by the victim, republishing them to infect even more users.

But what sets this attack apart is its terrifying dead man’s switch. The malware continuously checks if it can access GitHub and npm.

If both channels are closed or blocked at the same time, such as through remediation efforts, the malware immediately triggers its destructive payload: on Windows, it attempts to erase all user files and overwrite the hard drive; on Linux and Mac systems, it overwrites files with random data and then deletes them, making recovery nearly impossible.

GitLab has confirmed that its own systems remain uncompromised, but warns that the threat is far from over.

The self-sustaining nature of Shai-Hulud, combined with its destructive failsafe, presents a nightmare scenario for the global developer ecosystem.

If defenders respond by shutting down repositories or revoking tokens, thousands of machines could simultaneously lose their data.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates