Loading malware…
Shai-Hulud is a self-propagating software supply-chain malware family associated with open-source ecosystem compromises, especially npm, and widely linked to the threat actor TeamPCP. It is best known for credential theft and worm-like propagation through stolen developer and CI/CD secrets. Since at least mid-2025, Shai-Hulud activity has targeted package registries, source-code hosting, build pipelines, developer workstations, cloud-connected environments, and AI-assisted development tooling.
Shai-Hulud and its descendants, including Mini Shai-Hulud and the 2026 ChainDrop variant, typically execute through malicious package lifecycle hooks or poisoned repository configuration files. Observed campaigns abused trusted maintainer accounts and legitimate release workflows to publish trojanized packages with authentic provenance, allowing malicious releases to appear legitimate. In later variants, the malware also planted execution hooks in developer tooling configurations so that opening an infected repository in environments such as VS Code or Claude Code could trigger payload execution even without a package installation step.
The malware’s core function is large-scale harvesting of credentials, tokens, API keys, cloud secrets, CI/CD material, and other sensitive data from local files, environment variables, shell configuration, runner memory, and application-specific credential stores. Reported targets include npm and GitHub tokens, GitHub Actions and other CI/CD secrets, cloud-provider credentials, Kubernetes and Vault material, SSH data, AI-tooling credentials, and in some campaigns cryptocurrency-related secrets. Stolen data is compressed, encrypted, and exfiltrated through attacker-controlled infrastructure; multiple campaigns also used victim-controlled GitHub repositories as dead-drop exfiltration channels.
Shai-Hulud propagates by reusing stolen publishing credentials to enumerate writable packages, modify package artifacts to include its loader and payload, increment versions, and republish malicious releases through normal registry channels. Some variants also used stolen GitHub credentials or app tokens to enumerate accessible repositories and branches, commit malicious configuration files, and seed additional developer-side execution paths. This makes the malware effective for lateral spread across maintainers, organizations, and downstream dependency chains.
Later Shai-Hulud lineage samples showed expanded defense-evasion and resilience features, including heavy obfuscation, execution under alternate runtimes, dynamic command-and-control discovery via blockchain-based dead-drop mechanisms, and revocation-triggered follow-on behavior. Campaigns attributed to this family have affected high-download JavaScript packages and broader developer ecosystems, with downstream exposure spanning enterprise software, CI/CD environments, cloud infrastructure, and open-source consumers worldwide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-10894 highlights how a single workflow misconfiguration can cascade into widespread compromise across the JavaScript ecosystem. The attack chain for CVE-2025-10894 began with exploitation of a GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants elevated permissions (including a writable GITHUB_TOKEN) to workflows running on pull requests from forks. Attackers crafted pull requests with titles containing bash injection payloads. | The campaign escalated with the release of a self-replicating worm (Shai-Hulud) that used harvested npm credentials to infect additional packages, resulting in over 500 compromised npm projects.
Shai-Hulud is a self-propagating, info-stealing malware that infects software components, uses the access to publish poisoned versions, and then harvests the repository accounts of those affected by the malware downstream.
359 GitHub repos created with encrypted stolen credentials — “Shai-Hulud: Here We Go Again.” CVE-2026-45321 published CVSS 9.6 critical. Mitre, CISA, and major registry operators issue coordinated advisories. | Shai-Hulud is, at this point, a very familiar name... The most recent one being the so-called Mini Shai-Hulud... they are back again... compromising the TanStack Router packages, and starting a brand new campaign based on Mini Shai-Hulud.
In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The compromise was blamed on and claimed by TeamPCP, the threat actor behind multiple open source software (OSS) supply chain attacks involving the Shai-Hulud worm.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.
researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.
A new wave of the Shai-Hulud supply chain campaign, adding 23 newly discovered malicious PyPI package-version artifacts to an already alarming operation that previously compromised 37 packages.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.
What happens when software supply-chain attacks compromise not only packages, but the trusted systems and workflows used to build and distribute them?
The preinstall hook runs an obfuscated setup.mjs that downloads a standalone Bun binary and executes the payload under it, sidestepping the host Node version and Node-level monitoring. | A successful C2 response can include a code field that the payload passes to eval
They were injected with a .pth file that Python automatically executed at interpreter startup, even if LiteLLM was never imported, bypassing ignore-scripts protections.
Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.
A watcher, installed as a Linux systemd user service or a macOS LaunchAgent, polls api.github.com/user with a stolen token roughly every 60 seconds.
A watcher, installed as a Linux systemd user service or a macOS LaunchAgent, polls api.github.com/user with a stolen token roughly every 60 seconds.
Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.
A watcher, installed as a Linux systemd user service or a macOS LaunchAgent, polls api.github.com/user with a stolen token roughly every 60 seconds.
A watcher, installed as a Linux systemd user service or a macOS LaunchAgent, polls api.github.com/user with a stolen token roughly every 60 seconds.
the harvester now sweeps AI-agent credential stores for Claude, OpenAI, Codex, Cursor, and Gemini alongside traditional secrets... GitHub Actions OIDC tokens and org/repo secrets, npm tokens
Secrets infrastructure: HashiCorp Vault tokens and Kubernetes service-account tokens... CI/CD and registries: GitHub Actions OIDC tokens and org/repo secrets, npm tokens
Cloud: AWS, GCP, and Azure instance metadata and IAM credentials, now joined by Alibaba Cloud and Tencent Cloud CLI configurations.
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
One of the most striking aspects of the campaign was its extensive use of legitimate platforms for C2 and exfiltration. Rather than relying exclusively on traditional malware infrastructure, the attackers used GitHub repositories as dead-drop locations for stolen data.
The preinstall hook runs an obfuscated setup.mjs that downloads a standalone Bun binary and executes the payload under it.
Results are posted over HTTPS to a /router path... Harvested data is committed to attacker-created GitHub repositories
The leaked code reflects previously observed Shai-Hulud behavior, including credential theft and exfiltration workflows that upload stolen data to GitHub repositories, send information to a predefined C2 server, and target secrets such as credentials and cryptocurrency wallets.
256 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware referenced in the article title; the content indicates it is discussed in the context of software supply-chain attacks compromising packages and trusted build/distribution workflows.
A self-replicating npm supply-chain worm that infects package tarballs and repository configuration files, steals npm tokens, GitHub credentials, cloud keys, and other secrets, exfiltrates the data to attacker-controlled endpoints, and propagates by rebuilding package tarballs with its payload and committing malicious VS Code/Claude configuration hooks into accessible repositories and branches.
A worm used in OSS supply chain attacks that automatically executes malicious code when infected packages are fetched and run, harvesting credentials, tokens, API keys, and other secrets, then using stolen developer secrets to modify accessible packages and publish malicious versions to registries.
A family of self-replicating package-ecosystem worms that steal credentials, abuse CI/CD and trusted publishing workflows, republish poisoned packages, exfiltrate stolen data, and in later variants add persistence and destructive fallback behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.