Shai-Hulud
Shai-Hulud is a self-propagating software supply-chain worm and credential-stealing malware family primarily associated with malicious npm packages, later expanding into PyPI and related developer tooling ecosystems. Multiple reports attribute early waves to TeamPCP, also tracked as UNC6780, though attribution after the public release of the worm’s source code on 2026-05-12 became less certain due to copycat reuse.
The malware targets developer workstations, CI/CD runners, GitHub repositories, package publishing pipelines, and cloud-connected build environments. Reported capabilities include harvesting npm and PyPI publishing credentials, GitHub tokens, GitHub CLI tokens, AWS credentials, Azure credentials, Google Cloud credentials, Kubernetes secrets, HashiCorp Vault credentials, SSH keys, Docker configuration, shell history, password-manager data, and other CI/CD secrets. Several analyses specifically describe theft from GitHub Actions runners, including scraping Runner.Worker process memory on Linux to obtain OIDC tokens and secrets, abuse of trusted publishing workflows, and use of compromised CI identities to publish malicious artifacts with valid provenance.
Propagation behavior is central to the family. Shai-Hulud uses stolen npm or repository credentials to modify packages, inject malicious code, publish poisoned releases, and backdoor repositories and workflows. Reported techniques include npm lifecycle-script abuse via preinstall/postinstall hooks, execution through binding.gyp/node-gyp to evade scanners focused only on package.json scripts, Bun-based staged payload execution, malicious GitHub Actions workflow injection, and persistence through IDE and developer-tool configuration files such as .claude/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and .gemini/settings.json. Persistence mechanisms also include systemd services, macOS LaunchAgents, Claude Code hooks, gh-token-monitor/dead-man-switch logic, and related token-monitoring components.
Exfiltration commonly uses GitHub as a dead-drop channel rather than a traditional C2 server. Reports describe the malware creating attacker-controlled or victim-account GitHub repositories, often storing encrypted stolen data under results/ paths and using campaign marker strings such as "Miasma: The Spreading Blight" or "Alright Lets See If This Works." Other reported infrastructure and markers linked to Shai-Hulud waves include the impersonation domain git-tanstack.com, staged camouflage using hxxps://api[.]anthropic[.]com/v1/api, and commit-search/dead-drop markers such as firedalazer and thebeautifulmarchoftime. The malware encrypts stolen data using public-key cryptography with AES-256-GCM; one linked incident reused the same 4096-bit RSA public key across Shai-Hulud-related tooling and a poisoned mistralai PyPI release.
The family has been tied in reporting to numerous supply-chain incidents affecting legitimate package ecosystems and trusted release channels, including Red Hat npm packages, TanStack, Leo/RStreams, LiteLLM, Trivy-related activity, Nx Console, @antv, durabletask on PyPI, and a malicious mistralai==2.4.6 release. Reported impacts range from hundreds to more than a thousand compromised packages and widespread downstream exposure in environments with AWS, GitHub, and CI/CD access. In one Fortinet-investigated case linked to Shai-Hulud tradecraft, stolen Jenkins/AWS instance-role credentials were used for cloud intrusion, IAM user creation, privilege escalation, Secrets Manager and Redshift access, and exfiltration staging.
Known high-confidence indicators and artifacts mentioned in the reporting include git-tanstack.com, hxxps://api[.]anthropic[.]com/v1/api, models.litellm.cloud, setup_bun.js, bun_environment.js, litellm_init.pth, updater.py, .github/workflows/discussion.yaml, .claude/settings.json, .cursor/rules/setup.mdc, and .vscode/tasks.json. Additional linked IOCs from a related poisoned mistralai release include IP 83.142.209.194, package mistralai==2.4.6, SHA256 6dbaa43bf2f3c0d3cddbca74967e952da563fb974c1ef9d4ecbb2e58e41fe81b for the package archive, and SHA256 5245eb032e336b85cff0dbb3450d591826bf2ef214fd30d7eba1a763664e151b for transformers.pyz.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-10894 highlights how a single workflow misconfiguration can cascade into widespread compromise across the JavaScript ecosystem. The attack chain for CVE-2025-10894 began with exploitation of a GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants elevated permissions (including a writable GITHUB_TOKEN) to workflows running on pull requests from forks. Attackers crafted pull requests with titles containing bash injection payloads. | The campaign escalated with the release of a self-replicating worm (Shai-Hulud) that used harvested npm credentials to infect additional packages, resulting in over 500 compromised npm projects.
Shai-Hulud is a self-propagating, info-stealing malware that infects software components, uses the access to publish poisoned versions, and then harvests the repository accounts of those affected by the malware downstream.
359 GitHub repos created with encrypted stolen credentials — “Shai-Hulud: Here We Go Again.” CVE-2026-45321 published CVSS 9.6 critical. Mitre, CISA, and major registry operators issue coordinated advisories. | Shai-Hulud is, at this point, a very familiar name... The most recent one being the so-called Mini Shai-Hulud... they are back again... compromising the TanStack Router packages, and starting a brand new campaign based on Mini Shai-Hulud.
In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly.
Groups observed using it
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Organizations with modern CI/CD pipelines face threats from the Shai Hulud supply chain campaign, a software worm attributed to TeamPCP that has been targeting npm and PyPI packages since late 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.
researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.
Techniques & procedures
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
MITRE Tactic Representative Techniques What We Observed Valid Accounts T1078.004 (Cloud accounts) Jenkins instance role used from external IPs
The Miasma malware campaign has claimed another victim, poisoning more than 20 versions of legitimate npm packages used by the Leo Platform and RStreams ecosystems... attackers compromised an npm maintainer account, "czirker," and used it to publish poisoned updates to more than 20 packages
optionalDependencies → github:tanstack/router#79ac49ee... as a standalone commit; ... Variant: @cap-js/openapi 1.4.1 only pointed optionalDependencies to an attacker-controlled GitHub commit, with no malicious files inside the package tarball. | The attacker forked zblgg/configuration, and PR #7378 triggered bundle-size.yml via pull_request_target, executing forked code within the secure context of the base repository.
Execution
4 techniques
Execution
~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service
When npm sees a package with binding.gyp and no explicit install script, it falls back to running node-gyp rebuild. During that process, node-gyp expands shell commands embedded in <!(...) expressions. Attackers can abuse this behavior to execute the payload during package installation... "sources" : [ "<!(node index.js > /dev/null 2>&1 && echo stub.c)" ]
After validating the signature, it downloads and executes remote Python content.
After decryption, Stage 2 writes the Core Malicious Payload to /tmp, executes it through Bun, and then deletes the temporary file. | All three samples trigger the attack chain through the preinstall lifecycle hook in package.json: "scripts" : { "preinstall" : "node index.js" } preinstall is automatically executed during the npm installation process.
Persistence
5 techniques
Persistence
~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service
MITRE Tactic Representative Techniques What We Observed Valid Accounts T1078.004 (Cloud accounts) Jenkins instance role used from external IPs
GitHub dead-drop exfiltration by creating repositories under a usable GitHub token and committing encrypted result files under results/ .
Privilege Escalation
4 techniques
Privilege Escalation
~/.config/systemd/user/gh-token-monitor.service ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.local/share/updater/update.py ~/.local/share/updater/ update-monitor.service
The samples embed memory-dumping scripts for Linux, Windows, and macOS... When GITHUB_ACTIONS === “true” and RUNNER_OS === “Linux”, the code locates the Runner.Worker process and dumps its memory.
Stealth
6 techniques
Stealth
Root-level router_init.js (approximately 2.3MB, triple-layer obfuscation...); ... index.js (498KB obfuscated)
The payload still contains Anthropic camouflage: api.anthropic.com v1/api As in the previous Miasma analysis, this appears to be use of a legitimate-looking API host/path as camouflage rather than evidence of a compromised Anthropic service.
The samples embed memory-dumping scripts for Linux, Windows, and macOS... When GITHUB_ACTIONS === “true” and RUNNER_OS === “Linux”, the code locates the Runner.Worker process and dumps its memory.
After decryption, Stage 2 writes the Core Malicious Payload to /tmp, executes it through Bun, and then deletes the temporary file.
Defense Impairment
1 technique
Defense Impairment
Credential Access
8 techniques
Credential Access
The code does not use SEED_PAT unconditionally. It first checks whether the GitHub Actions GITHUB_REPOSITORY environment value contains Seeder. Only in that case does it read SEED_PAT and add that token as a GitHub sender.
the payload begins collecting credentials stored across files, environment variables, shell history, GitHub CLI tokens, cloud access keys, and CI/CD pipeline secrets.
It retains the familiar behavior: Broad credential collection from files, environment variables, shell history, GitHub CLI tokens, cloud credentials, package-manager tokens, and CI/CD environments.
It retains the familiar behavior: Broad credential collection from files, environment variables, shell history, GitHub CLI tokens, cloud credentials, package-manager tokens, and CI/CD environments.
On the Jenkins host, investigators observed access to the instance metadata service (IMDS) consistent with credential theft: curl -s --connect-timeout 3 hxxp://169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/
It retains the familiar behavior: Broad credential collection from files, environment variables, shell history, GitHub CLI tokens, cloud credentials, package-manager tokens, and CI/CD environments.
Discovery
3 techniques
Discovery
The Core Malicious Payload detects multiple EDR and security products by checking process names and installation paths
Lateral Movement
2 techniques
Lateral Movement
Command and Control
2 techniques
Command and Control
Exfiltration
3 techniques
Exfiltration
GitHub dead-drop exfiltration by creating repositories under a usable GitHub token and committing encrypted result files under results/ ... If a usable token is available, it can create a repository under the token owner and write result files under: results/results-<timestamp>-<counter>.json
IOCs tracked for this family
203 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a supply-chain payload previously seen using simpler single-block prompt-injection techniques.
Named malware referenced as worming through poisoned Red Hat npm package versions in the npm ecosystem.
A software worm targeting npm and PyPI packages that executes during installs or CI jobs, harvests build and cloud credentials, republishes poisoned packages, and enables follow-on compromise of cloud infrastructure.
A supply-chain worm family targeting npm and developer ecosystems. It executes during package installation, steals cloud and developer credentials, exfiltrates them via GitHub dead-drop repositories, propagates by republishing compromised packages and backdooring repositories, and can persist through AI coding assistant and editor configuration hooks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.