The Self-Propagating Shai-Hulud Worm Infects the npm Ecosystem
A dangerous worm dubbed Shai-Hulud has been uncovered in the JavaScript ecosystem, infecting at least 187 packages in the NPM repository. What sets it apart is that it not only steals developer credentials but also propagates autonomously, publishing new versions of libraries laced with malicious code. Once inside a system, the malware hunts for NPM tokens, modifies up to twenty of the most popular packages accessible to the token owner, and republishes their tainted copies. Each subsequent installation of an infected component results in the theft of additional secrets, which are then uploaded to public GitHub repositories under the ominous marker Shai-Hulud.
The campaign is being investigated by experts from Aikido, StepSecurity, and socket.dev. According to their findings, the first compromised package was altered on September 14. The worm leverages TruffleHog to scour a developer’s environment for access keys and tokens, while also attempting to create GitHub Actions and exfiltrate discovered secrets. Its focus lies on Linux and macOS systems, deliberately ignoring Windows. For cloud environments, Shai-Hulud is capable of extracting data from AWS, Azure, and Google Cloud Platform.
Particular alarm was sparked when packages published under the name of CrowdStrike were compromised. Socket.dev recorded at least 25 such libraries, though NPM quickly purged them from public access. CrowdStrike has assured that its core Falcon platform remains unaffected, clarifying that the malicious modules were not linked to company products, the exposed keys were revoked, and an internal investigation is ongoing.
What makes Shai-Hulud especially perilous is not merely its use of stolen tokens, but the cascading infection chain it unleashes: one compromised account can corrupt all of its associated packages. Such a design turns a single lapse in vigilance into a potential avalanche of infections. Researchers liken the attack to a living organism—lying dormant at times, only to reawaken with each fresh compromise. Although new infections appear to be slowing, the threat of resurgence remains.
This outbreak follows a spate of recent assaults on NPM. A large-scale phishing campaign with fake prompts to update multi-factor authentication settings seeded dozens of malicious packages aimed at cryptocurrency theft. In August, the popular nx tool—downloaded millions of times weekly—was compromised with injected code that harvested keys and tokens, created a new public repository within the victim’s GitHub account, and dumped the stolen data there. Unlike Shai-Hulud, however, that malware lacked the ability to self-propagate.
Industry specialists have described the incident as a “supply chain attack squared.” They argue that the only viable safeguard may be the introduction of a hardened two-factor scheme for package publication, mandating human confirmation for every release. Without such controls, automated workflows remain an open gateway for adversaries.
Shai-Hulud demonstrates with stark clarity the fragility of today’s software supply chains. Mass infections delivered through trusted packages jeopardize the very fabric of the development process, and until the ecosystem embraces stricter safeguards and authentication standards, such outbreaks are destined to recur.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
