Shai-Hulud

The npm package 'tensorlake' was compromised in a supply chain attack delivering a credential-stealing and self-propagating worm named Shai-Hulud. The malicious version 0.5.144 includes a preinstall hook that executes an obfuscated JavaScript loader, which deploys malware to harvest credentials from npm, GitHub, AWS, Kubernetes, Vault, SSH keys, and cryptocurrency wallets. The malware establishes persistence, exfiltrates data via GitHub repositories, uses Ethereum for C2 resolution, and can trigger destructive actions if stolen tokens are revoked. It also modifies project files in AI development environments to re-execute upon project access.

Shai-Hulud is a self-propagating worm that first appeared on npm in September 2025 by compromising the @ctrl/tinycolor package, which had over two million weekly downloads. The worm harvested credentials using TruffleHog, exfiltrated data to a public GitHub repository named Shai-Hulud, and used stolen npm tokens to propagate to other packages maintained by the victim. It established persistence via GitHub Actions workflows and evolved through multiple waves in late 2025 and 2026, with increasing sophistication and destructive capabilities. In May 2026, the source code was released publicly by TeamPCP, leading to widespread replication and new campaigns, including one leveraging short-lived OIDC tokens in CI environments. The original authors remain unattributed, though two alleged members of TeamPCP were arrested in August 2026.

An attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider and used it to recommend a poisoned PyPI package, which was accepted by a developer. This allowed the attacker to install an infostealer, steal GitHub OAuth tokens, and deploy the self-spreading Shai-Hulud worm across approximately 100 internal code repositories. The attacker also poisoned a package in the company's official namespace, leading to a second infection when another employee pulled the compromised version.

Over a 12-month period from August 2025 to August 2026, 56 distinct open source supply chain attacks were observed, with a significant increase in frequency starting in March 2026. These attacks primarily involved malicious compromises of trusted packages across npm, PyPI, RubyGems, Composer, and crates.io, as well as GitHub Actions and IDE extensions, designed to steal CI/CD credentials. A key trend is the rise of self-propagating worms such as Shai-Hulud, CanisterWorm, Miasma, and ChainDrop, which leverage stolen tokens to infect downstream packages at scale. The Team PCP campaign in March 2026 exemplifies the severity, compromising widely used components like Trivy Action, KICS Action, telnyx, and LiteLLM to harvest credentials across major CI/CD platforms.

ChainDrop is a self-propagating npm worm that infected over 400 packages, including widely used ones like keyv and cacheable-request, enabling it to steal cloud credentials, npm and GitHub tokens, SSH keys, and other sensitive developer data. The worm uses a combination of domain-based and GitHub-based exfiltration, with C2 infrastructure resolved via an Ethereum smart contract, allowing silent domain rotation through blockchain transactions. It establishes persistence through VS Code and Claude Code configurations, targets CI runners to extract ephemeral OIDC tokens, and can republish infected packages while preserving legitimate functionality, making detection difficult.

In H1 2026, a surge in cloud-based threats was driven by aggressive software supply-chain attacks, particularly by the group TeamPCP, which compromised developer toolchains across npm, PyPI, and VSCode extensions to steal credentials and propagate across cloud environments. TeamPCP's malware evolved to exploit CI misconfigurations, extract OIDC tokens, and deploy wipers with Dune-themed taunts. North Korea's UNC1069 conducted parallel campaigns, trojanizing the axios package and compromising over 140 @mastra-related packages. The open-sourced Shai-Hulud worm enabled follow-on attacks like IronWorm, which used Rust-based binaries and eBPF rootkits for stealth. A new extortion group, JINX-0163, emerged, targeting cloud identities across AWS, Azure, and GCP to steal secrets and enable ransom threats via the alias 'FulcrumSec'.

Unit 42 has identified a growing threat called 'token jacking,' where cybercriminals steal API keys (tokens) used to access AI platforms, leading to massive financial losses due to unmonitored usage. These stolen tokens are often funneled into 'transfer stations'—gray-market services that resell discounted AI computing capacity—using proxy platforms like new-api or one-api. Attackers obtain tokens via phishing, information stealers, or malicious npm packages such as Shai-Hulud and Miasma, which self-propagate and harvest credentials from development environments. The stolen tokens are then used to generate millions of API calls, resulting in hundreds of thousands of dollars in unauthorized charges before detection.

A massive supply-chain attack dubbed ChainDrop has compromised over 1,300 npm packages with a combined 2 billion monthly downloads. The attack began with the compromise of the Keyv maintainer's GitHub account, allowing the threat actor to push malicious code directly to main branches and publish poisoned versions through legitimate CI/CD workflows. The malware, named ChainDrop and based on the Shai-Hulud worm, includes a dropper (setup.mjs) and an obfuscated infostealer (Math_Symbol.js) that collects developer and cloud credentials, encrypts them, and exfiltrates them to a public GitHub repository. The attack spreads laterally by self-propagating to other packages maintained by developers whose environments were infected.

Threat actors are increasingly targeting GitHub Actions secrets through campaigns like GhostAction and Megalodon, which exfiltrated thousands of secrets from public repositories. These attacks exploit the accumulation of unused, stale, or long-lived credentials that organizations fail to clean up. The Shai-Hulud worm exemplifies the risk, spreading by stealing npm tokens to publish malicious packages. Transitioning to OIDC-based authentication and eliminating unused secrets can reduce the attack surface significantly.

AI music generator Suno suffered a breach stemming from the Shai-Hulud worm, which compromised a developer's machine and exfiltrated GitHub and cloud credentials. The attacker, using the handle ellie.191, accessed Suno's source code, customer data, and payment information without the company's public notification. The breach highlights the ongoing impact of the Shai-Hulud campaign, which spreads via trojanized npm, PyPI, and Packagist packages and exfiltrates credentials to public GitHub repositories.