Shai-Hulud npm Worm Compromises Supply Chain
The Initial JavaScript Breach
A single installation of a routine JavaScript library could expose a company’s cloud infrastructure, repositories, and internal services to attackers. The Shai-Hulud npm worm infiltrated highly popular packages. Users download these packages over two billion times monthly. Subsequently, the worm propagated using stolen developer credentials. The number of infected components multiplied rapidly. Recent estimates indicate the total now exceeds one thousand.
The offensive commenced on August 4. Attackers successfully compromised the GitHub account of developer Jared Wray. He maintains the keyv library and several prominent caching tools. The infiltrators injected malicious files directly into the primary project branches. Following this, they released new versions using the standard GitHub Actions mechanism. Consequently, the infected builds acquired valid npm signatures and legitimate provenance data. Therefore, they appeared externally as entirely authentic updates.
Widespread Impact and Propagation
The breach compromised keyv, flat-cache, file-entry-cache, cacheable, cache-manager, and other vital libraries. Developers frequently integrate these packages indirectly through complex dependency chains. The initially infected packages alone amassed hundreds of millions of weekly downloads. Furthermore, researchers discovered malicious component versions associated with Deliveroo, OneReach, Picsart, Qlik, and other corporations. However, total download metrics do not equal the number of infected devices. Single projects often download multiple interrelated libraries simultaneously.
Each compromised version harbored the setup.mjs and Math_Symbol.js files. Additionally, they included a malicious preinstall command within the package.json file. Upon executing the npm install command, the malicious code triggered automatically. This execution occurred well before the installation process concluded. The clandestine loader silently downloaded the Bun runtime environment. Next, it executed the primary obfuscated payload, which measured approximately 728 kilobytes.
Data Exfiltration Mechanisms
The sophisticated malware actively hunted for npm and GitHub tokens. It also targeted AWS keys, Kubernetes secrets, Docker credentials, and tokens for HashiCorp Vault, Slack, and Stripe. Moreover, the scanner aggressively probed .env files, VPN configurations, and KeePass databases. It scrutinized Terraform states, development environment settings, private SSH keys, and database connection strings. On macOS and Linux systems, the program deployed roughly 200 distinct search patterns. Meanwhile, it read up to 64 files simultaneously.
The worm systematically encrypted the harvested data. Finally, it transmitted this information to public GitHub repositories bearing the description “Shai-Hulud: Here We Go Again”. Investigators ultimately identified approximately 1,300 such repositories. If the GitHub upload failed, the malware possessed a fallback mechanism. It contacted the npm-cache.com domain, which attackers registered in May 2026. The stolen tokens empowered the worm to publish infected package versions under the guise of new developers.
Mitigation and Remediation Strategies
Consequently, the attack propagated seamlessly from one project to another. It completely bypassed the need for manual account compromises. As detailed in an analysis of how keyv and associated packages were compromised in this npm supply chain attack, security specialists concluded that criminals frequently extracted publishing tokens directly from build servers. These servers had previously installed the infected dependencies.
Security experts strongly advise developers to audit their lock files meticulously. They must also review CI/CD logs and examine all dependencies, including devDependencies. Development teams that installed affected versions after the attack commenced must take immediate action. They must aggressively rotate their npm and GitHub tokens, cloud access keys, CI secrets, and Vault credentials. To mitigate future risks, specialists recommend pinning strictly safe library versions. Developers should utilize overrides in npm, yarn, or pnpm package managers. Furthermore, they should execute installations in build systems using the –ignore-scripts parameter whenever installation scripts remain unnecessary.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
