Massive "Shai-Hulud" npm Supply-Chain Attack Compromises Over 1,280 Packages and 2 Billion Monthly Installs

Executive Overview

The global software development ecosystem is grappling with one of the most aggressive and fast-moving supply-chain attacks in recent memory. Cybersecurity researchers from Aikido Security and Endor Labs have sounded the alarm over a rapidly spreading malware campaign linked to the notorious "Shai-Hulud" threat group. This sophisticated worm has successfully compromised well over 1,280 npm software packages—with the affected libraries collectively accounting for more than 2 billion installations every month.

The assault began when threat actors hijacked the GitHub account of a prominent open-source maintainer, pushing poisoned updates directly to the main branch of widely used utility libraries. By weaponizing automated CI/CD pipelines, the attackers managed to bypass traditional visual checks, publishing malicious versions bearing valid GitHub Actions provenance. As a result, developers downloading seemingly legitimate packages unwittingly executed heavily obfuscated droppers that harvested sensitive credentials, deployment tokens, and cloud infrastructure secrets.

The malware’s worm-like propagation mechanism allows it to continually infect new packages by harvesting authorization tokens from infected build runners, escalating into a multi-tiered crisis affecting individual developers, major enterprises, and foundational software dependencies alike.

Detailed Chronology: How the Attack Unfolded

The Initial Breach

The incident trace points back to the early morning hours of August 4. According to Ilyas Makari, a malware researcher at Aikido Security, the bad actors successfully compromised the GitHub account of Jared Wray, the core maintainer behind keyv. Keyv is a crucial key-value storage library that enjoys approximately 127 million weekly downloads on the npm registry.

With unauthorized administrative access to Wray’s repository, the attackers bypassed standard peer-review mechanisms by pushing malicious files directly to the main branch. They immediately triggered a new release cycle, flooding the npm registry with compromised package versions. Because these updates originated from legitimate maintainer workflows, they carried valid provenance signed by GitHub Actions—a feature that lulled automated vulnerability scanners and security teams into a false sense of security.

Kiran Raj, a security researcher and engineer at Endor Labs, noted a consistent operational pattern across the vector. "The pattern is consistent across them: an npm publishing token was stolen and used to push malicious versions, in most cases a CI or service-account token likely harvested from a build runner that had itself installed a poisoned dependency."

Rapid Propagation and Scale

What began as a localized account compromise quickly metastasized into a systemic worm outbreak. Wray’s administrative reach extended well beyond keyv; he also controls eight other high-profile packages, including foundational caching utilities such as:

• flat-cache (565 million monthly downloads)
• file-entry-cache (557 million monthly downloads)
• cacheable/utils (34 million monthly downloads)
• cacheable (29 million monthly downloads)
• cacheable/memory (28 million monthly downloads)
• cache-manager (16 million monthly downloads)

As these heavily downloaded libraries were integrated into downstream projects, any developer or automated build environment that pulled the updates inadvertently executed the embedded installation scripts. The malware immediately went to work harvesting the host environment’s npm and GitHub publishing tokens. Armed with these fresh credentials, the worm automatically authenticated and pushed malicious updates to other repositories controlled by the newly compromised identities.

The sheer speed of the infection stunned security analysts. Charlie Eriksen, a security researcher at Aikido, reported that new packages were becoming infected at an alarming rate of 50 to 100 every few minutes. At the height of the automated rampage, researchers observed the infection footprint surge past 1,280 unique packages spanning over 1,800 versions.

Supporting Context & Metrics: The Anatomy of the Shai-Hulud Campaign

The Threat Actor Profile

Industry analysts have attributed this campaign to the "Shai-Hulud" threat cluster, a notorious moniker borrowed from science fiction that first emerged late last year. Known for aggressive, worm-like proliferation through open-source registries, the Shai-Hulud campaign relies on automated credential harvesting to pivot laterally across developer networks, corporate systems, and open-source infrastructure.

Once the malware extracts sensitive data from a victim’s machine, it packages the intelligence and exfiltrates it to a public GitHub repository bearing the telltale description: "Shai-Hulud: Here We Go Again."

Technical Mechanics: Payload and Execution

Every infected package deployed in this campaign delivered a standardized, malicious payload consisting of a preinstall entry along with two core files: setup.mjs and Math_Symbol.js.

1. The Dropper (setup.mjs): Whenever an engineer executed npm install on an affected version, the preinstall script automatically triggered setup.mjs before the package installation could finalize. This file functioned as a heavily obfuscated dropper whose sole purpose was to silently fetch the Bun JavaScript runtime directly from official GitHub releases (github.com/oven-sh/bun/releases/download/bun-v1.3.13/).
2. The Core Payload (Math_Symbol.js): Utilizing the newly downloaded Bun runtime, the system executed Math_Symbol.js. Weighing in at 728 KB, this file is deeply obfuscated and acts as an advanced information-stealing engine. It systematically catalogs system architecture, roots out developer credentials, encrypts the haul, and uploads it to the attacker’s staging repository.

Comprehensive Credential Harvester

The Math_Symbol.js payload is equipped with targeted extractors designed to pillage specific secret stores on the victim’s filesystem. Among the primary targets are:

• npm and GitHub personal access tokens (PATs)
• Amazon Web Services (AWS) access keys and credentials
• Kubernetes configuration and secret files
• HashiCorp Vault tokens
• Stripe and Slack API tokens

Furthermore, the malware features a deep filesystem scanner built for macOS and Linux environments. This scanner executes approximately 200 distinct glob patterns across the host’s directory structure to locate high-value artifacts, including:

• Private and public SSH keys and configuration profiles
• Terraform state files containing plaintext resource attributes
• Docker registry authentication credentials
• KeePass password manager databases
• VPN connection profiles and Integrated Development Environment (IDE) configuration stores

To maintain stealth and efficiency, the scanner bypasses any files larger than 5 MB and executes up to 64 concurrent read operations. A generic regular expression (regex) engine is deployed simultaneously to comb through all scanned documents, flagging PEM private keys, Azure storage connection strings, embedded database credentials, and generic key=value patterns matching common enterprise secret fields.

Enterprise Impact and Collateral Damage

While the open-source community serves as the primary breeding ground for software supply-chain attacks, the downstream consequences inevitably bleed into enterprise environments. Because modern software development relies heavily on transitive dependencies—packages brought in indirectly by other libraries—multinational corporations and well-funded tech enterprises quickly found themselves in the crosshairs.

Reports indicate that the Shai-Hulud worm successfully infiltrated packages tied to prominent corporate entities across various industry verticals:

• Deliveroo: The global online food and grocery delivery titan.
• OneReach: An advanced AI orchestration and workflow automation platform vendor.
• ServiceTitan: A leading provider of cloud-based software for field service management.
• Picsart: A popular AI-powered photo and video editing ecosystem.
• Qlik: An enterprise software firm specializing in business intelligence, data integration, and analytics.

The involvement of these organizations highlights a sobering reality: enterprise perimeters are increasingly porous when software dependencies are implicitly trusted. A single compromised utility package utilized in an internal CI/CD build pipeline can instantly compromise proprietary source code, internal staging environments, and production cloud infrastructure.

Mitigation, Remediation, and Defense Strategies

Securing an environment against fast-moving, worm-like supply-chain attacks requires a multi-layered defensive posture. Security engineers at Endor Labs and Aikido Security have outlined immediate action items for affected organizations and proactive measures for the broader developer community.

Immediate Incident Response Steps

1. Pin and Roll Back Dependencies: Organizations must immediately audit their dependency trees and roll back any instances of keyv, flat-cache, file-entry-cache, and associated packages to versions released prior to August 4.
2. Leverage Package Overrides: Utilize native dependency override features in package managers (npm overrides, yarn resolutions, or pnpm overrides) to force safe versions of transitive dependencies across the entire project structure.
3. Comprehensive Credential Rotation: Assume that any machine, developer workstation, or CI/CD runner that executed an npm install command after 09:30 UTC has been compromised. Immediately rotate all exposed secrets, including:
   • npm publishing tokens
   • GitHub Personal Access Tokens (PATs)
   • Cloud provider credentials (AWS, Azure, GCP)
   • CI/CD pipeline secrets and deployment keys
   • HashiCorp Vault and API tokens
4. Audit Lockfiles and Logs: Scan local lockfiles, continuous integration logs, and dependency manifests (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml) for malicious version strings, paying special attention to devDependencies that execute during the build phase.

Proactive Hardening Guidelines

• Disable Installation Scripts in CI: Administrators should consistently utilize the --ignore-scripts flag when running installation commands in automated CI/CD pipelines (e.g., npm install --ignore-scripts). This simple configuration blocks the execution of post-install and pre-install hooks, rendering this entire class of install-hook malware completely inert.
• Scrutinize Provenance Warnings: As demonstrated by this attack, valid cryptographic provenance from GitHub Actions only verifies where a binary was built—it does not guarantee the integrity of the underlying source code if the maintainer’s account has been compromised. Organizations must adopt behavioral monitoring alongside cryptographic verification.
• Implement Zero-Trust Dependency Management: Security teams should deploy software composition analysis (SCA) tools capable of real-time anomaly detection, blocking unvetted package updates, and monitoring anomalous outbound network requests originating from build runners.

Future Outlook

The rapid escalation of the Shai-Hulud campaign underscores a systemic vulnerability in the modern software supply chain: the over-reliance on trusted maintainer accounts and automated publishing pipelines. As threat actors refine their ability to hijack legitimate developer credentials and scale their operations via automated worms, traditional perimeter security models are rendered obsolete.

Open-source registries, maintainers, and enterprise consumers must collectively shift toward a zero-trust model for third-party code. Moving forward, the industry will likely see increased pressure for mandatory multi-factor authentication (MFA) hardware keys for all package maintainers, stricter validation of preinstall lifecycle scripts, and the widespread adoption of automated sandbox environments for dependency evaluation. Until the ecosystem undergoes these structural reforms, campaigns like Shai-Hulud will remain one of the most potent and disruptive vectors facing the digital economy.