socket-dev · Crawled Sep 19, 2026

Happy Birthday, Shai-Hulud

6 IoCs 1 Actors 1 Malware

AI Summary

Shai-Hulud is a self-propagating worm that first appeared on npm in September 2025 by compromising the @ctrl/tinycolor package, which had over two million weekly downloads. The worm harvested credentials using TruffleHog, exfiltrated data to a public GitHub repository named Shai-Hulud, and used stolen npm tokens to propagate to other packages maintained by the victim. It established persistence via GitHub Actions workflows and evolved through multiple waves in late 2025 and 2026, with increasing sophistication and destructive capabilities. In May 2026, the source code was released publicly by TeamPCP, leading to widespread replication and new campaigns, including one leveraging short-lived OIDC tokens in CI environments. The original authors remain unattributed, though two alleged members of TeamPCP were arrested in August 2026.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware Shai-Hulud → Threat Actor TeamPCP →

Indicators of Compromise 6 extracted

Type	Value	Detail
Package	@ctrl/tinycolor	Details →
Filename	bundle.js	Details →
Filename	setup_bun.js	Details →
Filename	bun_environment.js	Details →
GitHub Repo	Shai-Hulud	Details →
GitHub User	TeamPCP	Details →

MITRE ATT&CK TTPs 28 techniques

T1021 Remote Services · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1059.001 PowerShell · Execution T1059.007 JavaScript · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1081 T1081 T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1133 External Remote Services · Persistence T1195 Supply Chain Compromise · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1485 Data Destruction · Impact T1528 Steal Application Access Token · Credential Access T1530 Data from Cloud Storage · Collection T1552 Unsecured Credentials · Credential Access T1553 Subvert Trust Controls · Defense Evasion T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1005 Data from Local System · Collection T1036.005 Match Legitimate Name or Location · Defense Evasion T1055 Process Injection · Defense Evasion T1070.004 File Deletion · Defense Evasion T1548.001 Setuid and Setgid · Privilege Escalation