Shai-Hulud 2.0: Aggressive & Automated, One Of Fastest Spreading NPM Supply Chain Attacks Ever Observed

In mid-September 2025, security researchers first identified a supply-chain compromise in the npm ecosystem, the original Shai-Hulud campaign. The first known compromised package was @ctrl/tinycolor version 4.1.1.

Only two months later, a far more aggressive and automated wave appeared: Shai-Hulud 2.0. The second wave of the Shai-Hulud campaign demonstrates an unprecedented level of automation and propagation speed, compromising hundreds of npm packages within hours. By chaining credential theft, self-replication, and automated republishing, the malware achieved rapid ecosystem-wide spread unlike anything previously observed in npm package supply-chain attacks.

What makes Shai-Hulud 2.0 different

Shai-Hulud 2.0 behaves like a worm, not a single compromised package. It automatically harvests and exfiltrates credentials and cloud secrets to attacker-controlled GitHub repositories, ultimately spreading to new npm accounts.

Analysis of the Shai-Hulud 2.0 payload

The attacker’s core payload is injected into npm packages through two files:

• setup_bun.js
• bun_environment.js

Once launched, the malware immediately initiates a credential-harvesting routine targeting common sources of developer secrets:

• GitHub tokens: It scans environment variables, GitHub CLI configuration files, and cached authentication artifacts for tokens.
• Cloud credentials: Using provider-specific SDKs and known file paths, parse known credential files
  • ~/.aws/credentials
  • application_default_credentials.json
  • azureProfile.json
• Npm tokens: It extracts registry publishing tokens from .npmrc files and relevant environment variables, locations where developers and CI systems commonly store npm credentials.
• Filesystem secret scanning: It downloads and runs Trufflehog, a legitimate secrets-discovery tool, and leverages it to scan the user’s home directory recursively. The secrets include configs, source repositories, .env files, and git history, enabling the malware to harvest API keys, passwords, and other embedded secrets with ease.

Functions to harvest all three popular CSPs are found in the payload, including:

list_AWS_secrets()
list_GCP_secrets()
list_Azure_secrets()

The malicious payload attempts to enumerate:

• AWS Secrets Manager secrets
• GCP Secret Manager entries
• Azure Key Vault secrets

In addition, the malicious payload has functions prepared to use Trufflehog and git, to find maintained packages, save files, and update packages.

github_save_file()
github_get_user()
githubGetPackagesByMaintainer()
githubUpdatePackage()
githubListRepos()
github_save_file()

Backdoor workflow and botnet-style GitHub persistence

One of the most alarming aspects of Shai-Hulud 2.0 is its use of GitHub Actions as a persistent backdoor into infected machines. After stealing a victim’s GitHub token, the malware registers the compromised host as a self-hosted runner under the name SHA1HULUD. This effectively enrolls the victim’s machine into the attacker’s remote-execution infrastructure.

The payload then plants a malicious workflow at .github/workflows/discussion.yaml. This workflow is deliberately crafted with an injection weakness and configured to run only on self-hosted runners. As a result, the attacker can trigger arbitrary command execution on any infected machine simply by opening a GitHub Discussion in the affected repository. This gives the attacker a persistent, stealthy foothold that blends in with normal CI/CD activity.

Beyond CLI-level control, the malware also uses stolen GitHub tokens to create public repositories that serve as exfiltration buckets. Each repository is stamped with a distinctive description marker: “Sha1-Hulud: The Second Coming.”, allowing the attacker to locate and manage them easily. These repos store stolen credentials and secret-scanning results.

Critically, Shai-Hulud 2.0 is designed to survive partial failures. If the initially stolen GitHub token lacks the necessary permissions, the malware searches GitHub for other compromised repositories that include the same “Second Coming” marker, named with a 18-character alphanumeric randomly-generated string.

Each repo may contain additional stolen tokens uploaded by other infected machines, organized in JSON files named after their contents with double base64 encoding.

If one of those tokens is valid, the malware adopts it, creating a distributed token-sharing network across all compromised hosts. This effectively forms a self-healing botnet inside GitHub, where compromised machines can rescue each other if tokens expire or lose privileges.

Supply-chain propagation through npm packages

Once GitHub persistence is established, the malware uses stolen npm tokens to weaponize the victim’s own packages, taking the following steps:

• Download all packages owned by the victim
• Inject the setup_bun.js loader into the preinstall hook
• Bundle the full bun_environment.js payload
• Automatically increment the patch version number
• Republish the modified package back to npm

Impact and ecosystem-wide spread

Shai-Hulud 2.0 has:

• Compromised hundreds of npm packages
• Affected major projects and organizations
• Resulted in tens of thousands of attacker-created GitHub repos

It represents a significant escalation in supply-chain attack sophistication.

Netskope Threat Labs identified the initial-stage payload retrieval activity associated with this campaign, with the detection “Script-JS.Worm.ShaiHulud”. Our investigations revealed no evidence of subsequent malicious downloads or second-stage payload executions, indicating that the attack chain did not progress beyond the first stage on Netskope-protected systems.

Indicators of Compromise (IOCs)

Malicious file hashes

bun_environment.js
62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0
f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068
cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd

setup_bun.js
a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a

Compromised Github users:

https://github.com/search?q=Sha1-Hulud%3A+The+Second+Coming.&type=repositories&s=updated&o=desc

Compromised npm packages