Sha1-Hulud Supply Chain Attack Compromises 800+ npm Packages and Thousands of GitHub Repos

Shai-Huluda, the self-replicating npm worm named after the sandworms in Frank Herbert’s Dune, has struck again with devastating scope.

This iteration of the attack compromised over 800 npm packages, totaling 132 million monthly downloads across the ecosystem.

According to Aikido Security research, the attack’s timing proved strategically devastating, occurring just weeks before npm’s December 9 deadline to revoke classic tokens, a pivotal security measure designed to combat supply-chain threats.

The worm exploited a critical window in which many developers remained unprepared for trusted publishing alternatives.

This vulnerability window provided attackers an ideal opportunity to maximize their impact before organizations could implement protective measures.

The sophistication and scale of this campaign represent a significant escalation from previous Shai-Hulud iterations.

Attack Mechanics and Propagation Strategy

Once installed on a developer’s system, Shai-Hulud executes automatically during package installation, even before completion.

The malware deploys multiple attack vectors simultaneously. First, it uses TruffleHog to scan for exposed secrets, including API keys, authentication tokens, GitHub credentials, and cloud access tokens.

Any sensitive information discovered is exfiltrated to a public GitHub repository labeled “Shai-Hulud: The Second Coming,” and researchers have identified 26,300 compromised repositories created by the attackers.

Second, the worm attempts self-propagation by publishing malicious copies to npm, enabling chain infections across additional packages and developers.

If authentication fails, the malware executes a scorched-earth tactic: wiping files from the user’s home directory to cause maximum damage.

This campaign demonstrates greater operational sophistication than previous waves. The worm now installs bun (a JavaScript runtime) via setup_bun.js before executing the actual payload through bun_environment.js.

Rather than hardcoding repository names, attackers generate random identifiers, complicating attribution and detection.

Critically, the attack scope expanded dramatically, targeting up to 100 npm packages per infection compared to 20 in previous campaigns.

The AsyncAPI team confirmed that attackers compromised their CLI repository directly, creating malicious branches and suggesting direct GitHub credential access.

With 132 million affected downloads, the blast radius spans thousands of organizations, many of which are unaware that their systems already contain the worm.

The npm community’s vulnerability stems from extraordinarily deep dependency chains that developers rarely audit comprehensively.

Combined with inadequate secret management practices and legacy token systems, supply-chain attacks remain devastatingly effective.

Security researchers discovered that some compromised packages contained only staging code without full worm payloads, suggesting operational mistakes that may have limited the impact of specific instances.

Organizations must recognize that package installation is a critical security event that requires active threat monitoring and credential protection, rather than mere administrative overhead.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates