{ "name": "Shai Hulud the second coming", "description": "The Shai Hulud campaign represents a new evolution in software supply chain attacks against the NPM ecosystem. At its core, the attacker hijacked maintainer accounts—through phishing and possible credential reuse—and injected a Webpack-bundled malicious payload (bundle.js) across dozens of packages, including the widely used @ctrl/tinycolor. Unlike earlier incidents focused on simple info-stealers or crypto hijacks, this malware introduced multi-stage propagation, credential harvesting, and persistence via GitHub Actions backdoors.\nConfirmed compromised packages: 198\n\n\nPotentially compromised packages: 410\n\n\nHigh-profile orgs affected now include @posthog, @ensdomains, @asyncapi, @postman, @zapier, @trigo, @actbase, and others.\n\nAttack Vector\n• Account Compromise: Maintainer accounts were targeted with phishing emails originating from support@npmjs[.]help, a typosquatted domain imitating npm’s legitimate support address. Victims were tricked into 2FA resets and credential harvesting.\n• Package Trojanization: Once inside, the attacker used the NpmModule.updatePackage function to download the package tarball, inject the malicious bundle.js, repack it, and republish compromised versions.\n• Self-Propagation: The code enumerated other packages owned by the same maintainer and recursively infected them. This mechanism amplified the blast radius, creating a cascading compromise across ecosystems.\n\nPayload Characteristics\n• Malicious Script (bundle.js):\n• Executed as part of a postinstall hook during npm install.\n• Built with Webpack for modularity, embedding reconnaissance, credential theft, and propagation routines.\n• Size ~3.6 MB, obfuscated to blend with legitimate dependencies.\n• Reconnaissance and Harvesting:\n• System profiling: os.platform(), architecture, and full process.env dumps.\n• Secret discovery: Repurposed TruffleHog to scan local filesystems for high-entropy secrets (API keys, cloud credentials).\n• Cloud enumeration:\n• AWS: Used @aws-sdk/client-secrets-manager to list and retrieve secrets.\n• GCP: Leveraged @google-cloud/secret-manager API.\n• Azure: Queried metadata endpoints for service principal tokens.\n• NPM tokens validated via /whoami.\n• GitHub personal access tokens exfiltrated when discovered.\n• Persistence and Lateral Movement:\n• Created a malicious GitHub Actions workflow (.github/workflows/shai-hulud-workflow.yml) that exfiltrated repository secrets on every push event.\n• Spawned malicious branches named shai-hulud across repositories to persistently re-inject workflows.\n• Abused git/refs and repos/contents GitHub APIs to automate workflow creation and ensure execution.\n• Exfiltration:\n• Collected data bundled into JSON, uploaded to attacker-controlled GitHub repos or sent to a webhook (webhook.site endpoint).\n• Payloads were double-base64 encoded to evade naive detections.\n• Network IOCs include: webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7.\n\nIndicators of Compromise (IOCs)\n• File Hashes: bundle.js SHA-256 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09.\n• GitHub workflow: .github/workflows/shai-hulud-workflow.yml.\n• Branches: shai-hulud.\n• Suspicious process executions:\n• trufflehog filesystem / --json\n• Forced npm publish --force commands.\n\nBlast Radius\n\nThis incident impacted more than 40 packages, including high-profile projects used across frontend and backend pipelines. Affected packages like @ctrl/tinycolor are deeply embedded in the JavaScript supply chain, meaning virtually every terminal renderer, CLI tool, or frontend bundle could indirectly include compromised versions.\nUnlike runtime-only payloads, this attack compromised the developer environment, build pipelines, and cloud infrastructure by targeting stored credentials. Once the GitHub Action backdoor was in place, the malware persisted even after uninstalling malicious NPM versions.\n\nKey Differences From Prior NPM Attacks\n• Self-propagating mechanism: Prior attacks (e.g., eslint-config-prettier compromise) relied on publishing one malicious version. Here, the malware infected all packages owned by maintainers.\n• Cross-cloud targeting: Explicit AWS, GCP, and Azure credential theft.\n• Persistent CI/CD compromise: Injected workflows in GitHub to maintain long-term access.\n• Selective targeting: Skipped Windows environments, focusing on Linux/macOS developers and CI agents.", "enabled": true, "responsibleUserEmail": "francesco cipollone (fc@securityphoenix.com)", "config": { "filters": [ { "organizationId": "ca237c1d-0b09-4b4e-9cba-e2fe534cdb9a", "cwes": null, "assetKey": null, "exploitabilities": null, "cvssVector": null, "assetLocality": null, "teamIds": null, "applicationId": null, "scannerIds": null, "scannerCategory": null, "severityLevels": null, "tagFilter": null, "productValue": null, "libraries": [ { "name": "@actbase/native", "version": null }, { "name": "@actbase/node-server", "version": null }, { "name": "@actbase/react-absolute", "version": null }, { "name": "@actbase/react-daum-postcode", "version": null }, { "name": "@actbase/react-kakaosdk", "version": null }, { "name": "@actbase/react-native-actionsheet", "version": null }, { "name": "@actbase/react-native-devtools", "version": null }, { "name": "@actbase/react-native-fast-image", "version": null }, { "name": "@actbase/react-native-kakao-channel", "version": null }, { "name": "@actbase/react-native-kakao-navi", "version": null }, { "name": "@actbase/react-native-less-transformer", "version": null }, { "name": "@actbase/react-native-naver-login", "version": null }, { "name": "@actbase/react-native-simple-video", "version": null }, { "name": "@actbase/react-native-tiktok", "version": null }, { "name": "@alexcolls/nuxt-socket.io", "version": null }, { "name": "@alexcolls/nuxt-ux", "version": null }, { "name": "@aryanhussain/my-angular-lib", "version": null }, { "name": "@asyncapi/avro-schema-parser", "version": null }, { "name": "@asyncapi/bundler", "version": null }, { "name": "@asyncapi/cli", "version": null }, { "name": "@asyncapi/converter", "version": null }, { "name": "@asyncapi/diff", "version": null }, { "name": "@asyncapi/dotnet-rabbitmq-template", "version": null }, { "name": "@asyncapi/edavisualiser", "version": null }, { "name": "@asyncapi/generator", "version": null }, { "name": "@asyncapi/generator-components", "version": null }, { "name": "@asyncapi/generator-helpers", "version": null }, { "name": "@asyncapi/generator-react-sdk", "version": null }, { "name": "@asyncapi/go-watermill-template", "version": null }, { "name": "@asyncapi/html-template", "version": null }, { "name": "@asyncapi/java-spring-cloud-stream-template", "version": null }, { "name": "@asyncapi/java-spring-template", "version": null }, { "name": "@asyncapi/java-template", "version": null }, { "name": "@asyncapi/keeper", "version": null }, { "name": "@asyncapi/markdown-template", "version": null }, { "name": "@asyncapi/modelina", "version": null }, { "name": "@asyncapi/modelina-cli", "version": null }, { "name": "@asyncapi/multi-parser", "version": null }, { "name": "@asyncapi/nodejs-template", "version": null }, { "name": "@asyncapi/nodejs-ws-template", "version": null }, { "name": "@asyncapi/nunjucks-filters", "version": null }, { "name": "@asyncapi/openapi-schema-parser", "version": null }, { "name": "@asyncapi/optimizer", "version": null }, { "name": "@asyncapi/parser", "version": null }, { "name": "@asyncapi/php-template", "version": null }, { "name": "@asyncapi/problem", "version": null }, { "name": "@asyncapi/protobuf-schema-parser", "version": null }, { "name": "@asyncapi/python-paho-template", "version": null }, { "name": "@asyncapi/react-component", "version": null }, { "name": "@asyncapi/server-api", "version": null }, { "name": "@asyncapi/specs", "version": null }, { "name": "@asyncapi/studio", "version": null }, { "name": "@asyncapi/web-component", "version": null }, { "name": "@caretive/caret-cli", "version": null }, { "name": "@clausehq/flows-step-jsontoxml", "version": null }, { "name": "@commute/bloom", "version": null }, { "name": "@commute/market-data", "version": null }, { "name": "@dev-blinq/ai-qa-logic", "version": null }, { "name": "@dev-blinq/cucumber_client", "version": null }, { "name": "@ensdomains/address-encoder", "version": null }, { "name": "@ensdomains/blacklist", "version": null }, { "name": "@ensdomains/buffer", "version": null }, { "name": "@ensdomains/ccip-read-cf-worker", "version": null }, { "name": "@ensdomains/ccip-read-dns-gateway", "version": null }, { "name": "@ensdomains/ccip-read-router", "version": null }, { "name": "@ensdomains/ccip-read-worker-viem", "version": null }, { "name": "@ensdomains/content-hash", "version": null }, { "name": "@ensdomains/curvearithmetics", "version": null }, { "name": "@ensdomains/cypress-metamask", "version": null }, { "name": "@ensdomains/dnsprovejs", "version": null }, { "name": "@ensdomains/dnssec-oracle-anchors", "version": null }, { "name": "@ensdomains/dnssecoraclejs", "version": null }, { "name": "@ensdomains/durin", "version": null }, { "name": "@ensdomains/durin-middleware", "version": null }, { "name": "@ensdomains/ens-archived-contracts", "version": null }, { "name": "@ensdomains/ens-avatar", "version": null }, { "name": "@ensdomains/ens-contracts", "version": null }, { "name": "@ensdomains/ens-test-env", "version": null }, { "name": "@ensdomains/ens-validation", "version": null }, { "name": "@ensdomains/ensjs", "version": null }, { "name": "@ensdomains/ensjs-react", "version": null }, { "name": "@ensdomains/eth-ens-namehash", "version": null }, { "name": "@ensdomains/hackathon-registrar", "version": null }, { "name": "@ensdomains/hardhat-chai-matchers-viem", "version": null }, { "name": "@ensdomains/hardhat-toolbox-viem-extended", "version": null }, { "name": "@ensdomains/mock", "version": null }, { "name": "@ensdomains/name-wrapper", "version": null }, { "name": "@ensdomains/offchain-resolver-contracts", "version": null }, { "name": "@ensdomains/op-resolver-contracts", "version": null }, { "name": "@ensdomains/react-ens-address", "version": null }, { "name": "@ensdomains/renewal", "version": null }, { "name": "@ensdomains/renewal-widget", "version": null }, { "name": "@ensdomains/reverse-records", "version": null }, { "name": "@ensdomains/server-analytics", "version": null }, { "name": "@ensdomains/solsha1", "version": null }, { "name": "@ensdomains/subdomain-registrar", "version": null }, { "name": "@ensdomains/test-utils", "version": null }, { "name": "@ensdomains/thorin", "version": null }, { "name": "@ensdomains/ui", "version": null }, { "name": "@ensdomains/unicode-confusables", "version": null }, { "name": "@ensdomains/unruggable-gateways", "version": null }, { "name": "@ensdomains/vite-plugin-i18next-loader", "version": null }, { "name": "@ensdomains/web3modal", "version": null }, { "name": "@everreal/web-analytics", "version": null }, { "name": "@hapheus/n8n-nodes-pgp", "version": null }, { "name": "@ifelsedeveloper/protocol-contracts-svm-idl", "version": null }, { "name": "@ifings/design-system", "version": null }, { "name": "@kvytech/cli", "version": null }, { "name": "@kvytech/components", "version": null }, { "name": "@kvytech/habbit-e2e-test", "version": null }, { "name": "@kvytech/medusa-plugin-announcement", "version": null }, { "name": "@kvytech/medusa-plugin-management", "version": null }, { "name": "@kvytech/medusa-plugin-newsletter", "version": null }, { "name": "@kvytech/medusa-plugin-product-reviews", "version": null }, { "name": "@kvytech/medusa-plugin-promotion", "version": null }, { "name": "@kvytech/web", "version": null }, { "name": "@lessondesk/api-client", "version": null }, { "name": "@lessondesk/babel-preset", "version": null }, { "name": "@lessondesk/eslint-config", "version": null }, { "name": "@lessondesk/schoolbus", "version": null }, { "name": "@louisle2/core", "version": null }, { "name": "@louisle2/cortex-js", "version": null }, { "name": "@markvivanco/app-version-checker", "version": null }, { "name": "@mcp-use/cli", "version": null }, { "name": "@mcp-use/inspector", "version": null }, { "name": "@mcp-use/mcp-use", "version": null }, { "name": "@mparpaillon/connector-parse", "version": null }, { "name": "@mparpaillon/imagesloaded", "version": null }, { "name": "@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode", "version": null }, { "name": "@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode", "version": null }, { "name": "@orbitgtbelgium/orbit-components", "version": null }, { "name": "@orbitgtbelgium/time-slider", "version": null }, { "name": "@osmanekrem/error-handler", "version": null }, { "name": "@posthog/agent", "version": null }, { "name": "@posthog/ai", "version": null }, { "name": "@posthog/automatic-cohorts-plugin", "version": null }, { "name": "@posthog/bitbucket-release-tracker", "version": null }, { "name": "@posthog/cli", "version": null }, { "name": "@posthog/clickhouse", "version": null }, { "name": "@posthog/core", "version": null }, { "name": "@posthog/currency-normalization-plugin", "version": null }, { "name": "@posthog/customerio-plugin", "version": null }, { "name": "@posthog/databricks-plugin", "version": null }, { "name": "@posthog/drop-events-on-property-plugin", "version": null }, { "name": "@posthog/event-sequence-timer-plugin", "version": null }, { "name": "@posthog/filter-out-plugin", "version": null }, { "name": "@posthog/first-time-event-tracker", "version": null }, { "name": "@posthog/geoip-plugin", "version": null }, { "name": "@posthog/github-release-tracking-plugin", "version": null }, { "name": "@posthog/gitub-star-sync-plugin", "version": null }, { "name": "@posthog/heartbeat-plugin", "version": null }, { "name": "@posthog/hedgehog-mode", "version": null }, { "name": "@posthog/icons", "version": null }, { "name": "@posthog/ingestion-alert-plugin", "version": null }, { "name": "@posthog/intercom-plugin", "version": null }, { "name": "@posthog/kinesis-plugin", "version": null }, { "name": "@posthog/laudspeaker-plugin", "version": null }, { "name": "@posthog/lemon-ui", "version": null }, { "name": "@posthog/maxmind-plugin", "version": null }, { "name": "@posthog/migrator3000-plugin", "version": null }, { "name": "@posthog/netdata-event-processing", "version": null }, { "name": "@posthog/nextjs", "version": null }, { "name": "@posthog/nextjs-config", "version": null }, { "name": "@posthog/nuxt", "version": null }, { "name": "@posthog/pagerduty-plugin", "version": null }, { "name": "@posthog/piscina", "version": null }, { "name": "@posthog/plugin-contrib", "version": null }, { "name": "@posthog/plugin-server", "version": null }, { "name": "@posthog/plugin-unduplicates", "version": null }, { "name": "@posthog/postgres-plugin", "version": null }, { "name": "@posthog/react-rrweb-player", "version": null }, { "name": "@posthog/rrdom", "version": null }, { "name": "@posthog/rrweb", "version": null }, { "name": "@posthog/rrweb-player", "version": null }, { "name": "@posthog/rrweb-record", "version": null }, { "name": "@posthog/rrweb-replay", "version": null }, { "name": "@posthog/rrweb-snapshot", "version": null }, { "name": "@posthog/rrweb-utils", "version": null }, { "name": "@posthog/sendgrid-plugin", "version": null }, { "name": "@posthog/siphash", "version": null }, { "name": "@posthog/snowflake-export-plugin", "version": null }, { "name": "@posthog/taxonomy-plugin", "version": null }, { "name": "@posthog/twilio-plugin", "version": null }, { "name": "@posthog/twitter-followers-plugin", "version": null }, { "name": "@posthog/url-normalizer-plugin", "version": null }, { "name": "@posthog/variance-plugin", "version": null }, { "name": "@posthog/web-dev-server", "version": null }, { "name": "@posthog/wizard", "version": null }, { "name": "@posthog/zendesk-plugin", "version": null }, { "name": "@postman/aether-icons", "version": null }, { "name": "@postman/csv-parse", "version": null }, { "name": "@postman/final-node-keytar", "version": null }, { "name": "@postman/mcp-ui-client", "version": null }, { "name": "@postman/node-keytar", "version": null }, { "name": "@postman/pm-bin-linux-x64", "version": null }, { "name": "@postman/pm-bin-macos-arm64", "version": null }, { "name": "@postman/pm-bin-macos-x64", "version": null }, { "name": "@postman/pm-bin-windows-x64", "version": null }, { "name": "@postman/postman-collection-fork", "version": null }, { "name": "@postman/postman-mcp-cli", "version": null }, { "name": "@postman/postman-mcp-server", "version": null }, { "name": "@postman/pretty-ms", "version": null }, { "name": "@postman/secret-scanner-wasm", "version": null }, { "name": "@postman/tunnel-agent", "version": null }, { "name": "@postman/wdio-allure-reporter", "version": null }, { "name": "@postman/wdio-junit-reporter", "version": null }, { "name": "@quick-start-soft/quick-document-translator", "version": null }, { "name": "@quick-start-soft/quick-git-clean-markdown", "version": null }, { "name": "@quick-start-soft/quick-markdown", "version": null }, { "name": "@quick-start-soft/quick-markdown-compose", "version": null }, { "name": "@quick-start-soft/quick-markdown-image", "version": null }, { "name": "@quick-start-soft/quick-markdown-print", "version": null }, { "name": "@quick-start-soft/quick-markdown-translator", "version": null }, { "name": "@quick-start-soft/quick-remove-image-background", "version": null }, { "name": "@quick-start-soft/quick-task-refine", "version": null }, { "name": "@seung-ju/next", "version": null }, { "name": "@seung-ju/openapi-generator", "version": null }, { "name": "@seung-ju/react-hooks", "version": null }, { "name": "@seung-ju/react-native-action-sheet", "version": null }, { "name": "@strapbuild/react-native-date-time-picker", "version": null }, { "name": "@strapbuild/react-native-perspective-image-cropper", "version": null }, { "name": "@strapbuild/react-native-perspective-image-cropper-2", "version": null }, { "name": "@strapbuild/react-native-perspective-image-cropper-poojan31", "version": null }, { "name": "@thedelta/eslint-config", "version": null }, { "name": "@tiaanduplessis/json", "version": null }, { "name": "@tiaanduplessis/react-progressbar", "version": null }, { "name": "@trefox/sleekshop-js", "version": null }, { "name": "@trigo/atrix", "version": null }, { "name": "@trigo/atrix-acl", "version": null }, { "name": "@trigo/atrix-elasticsearch", "version": null }, { "name": "@trigo/atrix-mongoose", "version": null }, { "name": "@trigo/atrix-orientdb", "version": null }, { "name": "@trigo/atrix-postgres", "version": null }, { "name": "@trigo/atrix-pubsub", "version": null }, { "name": "@trigo/atrix-redis", "version": null }, { "name": "@trigo/atrix-soap", "version": null }, { "name": "@trigo/atrix-swagger", "version": null }, { "name": "@trigo/bool-expressions", "version": null }, { "name": "@trigo/eslint-config-trigo", "version": null }, { "name": "@trigo/fsm", "version": null }, { "name": "@trigo/hapi-auth-signedlink", "version": null }, { "name": "@trigo/jsdt", "version": null }, { "name": "@trigo/keycloak-api", "version": null }, { "name": "@trigo/node-soap", "version": null }, { "name": "@trigo/pathfinder-ui-css", "version": null }, { "name": "@trigo/trigo-hapijs", "version": null }, { "name": "@varsityvibe/api-client", "version": null }, { "name": "@varsityvibe/validation-schemas", "version": null }, { "name": "@zapier/ai-actions", "version": null }, { "name": "@zapier/ai-actions-react", "version": null }, { "name": "@zapier/babel-preset-zapier", "version": null }, { "name": "@zapier/browserslist-config-zapier", "version": null }, { "name": "@zapier/eslint-plugin-zapier", "version": null }, { "name": "@zapier/mcp-integration", "version": null }, { "name": "@zapier/secret-scrubber", "version": null }, { "name": "@zapier/spectral-api-ruleset", "version": null }, { "name": "@zapier/stubtree", "version": null }, { "name": "@zapier/zapier-sdk", "version": null }, { "name": "asyncapi-preview", "version": null }, { "name": "atrix", "version": null }, { "name": "atrix-mongoose", "version": null }, { "name": "axios-builder", "version": null }, { "name": "axios-cancelable", "version": null }, { "name": "axios-timed", "version": null }, { "name": "barebones-css", "version": null }, { "name": "blinqio-executions-cli", "version": null }, { "name": "bool-expressions", "version": null }, { "name": "bun-plugin-httpfile", "version": null }, { "name": "bytecode-checker-cli", "version": null }, { "name": "bytes-to-x", "version": null }, { "name": "calc-loan-interest", "version": null }, { "name": "capacitor-plugin-apptrackingios", "version": null }, { "name": "capacitor-plugin-purchase", "version": null }, { "name": "capacitor-plugin-scgssigninwithgoogle", "version": null }, { "name": "capacitor-purchase-history", "version": null }, { "name": "capacitor-voice-recorder-wav", "version": null }, { "name": "chrome-extension-downloads", "version": null }, { "name": "claude-token-updater", "version": null }, { "name": "coinmarketcap-api", "version": null }, { "name": "command-irail", "version": null }, { "name": "compare-obj", "version": null }, { "name": "cpu-instructions", "version": null }, { "name": "create-glee-app", "version": null }, { "name": "create-hardhat3-app", "version": null }, { "name": "create-mcp-use-app", "version": null }, { "name": "crypto-addr-codec", "version": null }, { "name": "designstudiouiux", "version": null }, { "name": "devstart-cli", "version": null }, { "name": "discord-bot-server", "version": null }, { "name": "dotnet-template", "version": null }, { "name": "drop-events-on-property-plugin", "version": null }, { "name": "enforce-branch-name", "version": null }, { "name": "eslint-config-trigo", "version": null }, { "name": "eslint-config-zeallat-base", "version": null }, { "name": "ethereum-ens", "version": null }, { "name": "evm-checkcode-cli", "version": null }, { "name": "exact-ticker", "version": null }, { "name": "expo-audio-session", "version": null }, { "name": "feature-flip", "version": null }, { "name": "fittxt", "version": null }, { "name": "flapstacks", "version": null }, { "name": "flatten-unflatten", "version": null }, { "name": "formik-error-focus", "version": null }, { "name": "formik-store", "version": null }, { "name": "fuzzy-finder", "version": null }, { "name": "gate", "version": null } ], "duplicateType": null, "openWithinLast": null, "search": null, "assetFilter": { "osNames": null, "hostnames": null, "netbiosNames": null, "vpc": null, "subnet": null, "resourceType": null, "resourceGroup": null, "repository": null, "fqdn": null, "ipRanges": null }, "negateFilter": null } ], "selectedIds": null, "notificationThreshold": 5 } }