Shai-Hulud: the worm that hid inside developers' own tools

In September 2025, a worm appeared in the npm ecosystem that changed the rules of supply chain security: Shai-Hulud. Its mechanism was as simple as it was devastating — steal an npm publish token, enumerate every package accessible with that token, inject malicious code, and republish automatically. No human intervention. No propagation limit.

What followed was a continuous escalation. In November and December 2025 came Shai-Hulud 2.0, with data-wiping capabilities. In March 2026, the group TeamPCP backdoored axios, the JavaScript library with 100 million weekly downloads. In April, Mini Shai-Hulud emerged targeting the SAP ecosystem. On May 11, 2026, Microsoft Security Research identified a new wave that compromised over 170 npm packages and 2 PyPI packages across 404 malicious versions — the first time a single coordinated attack spanned both registries simultaneously.

🔍 Suspicious message?

Analyze senders, links or files in real time with our scanner.

Analyze now

What is Shai-Hulud and why the name

Shai-Hulud is the name of the giant sandworms from Frank Herbert's novel Dune — creatures that move beneath the surface, invisible until they emerge to devour everything in their path. The parallel is precise: the malware lives inside development infrastructure, invisible to traditional defense systems, and spreads beneath the surface of CI/CD pipelines without anyone noticing until the damage is done.

Technically it is a supply chain worm: malware designed specifically to live and reproduce inside the systems developers use to build software. It does not attack end-user computers — it attacks the tools that build the applications millions of people use.

How the attack works

The infection cycle of Mini Shai-Hulud (the May 2026 variant) is more sophisticated than its predecessors and does not require a stolen token as an entry point. Instead it uses a chain of three techniques:

1. GitHub Actions cache poisoning

The attacker submits an apparently legitimate pull request to a popular package repository. GitHub Actions runs the CI/CD pipeline to validate it. During that execution, the worm poisons the Actions cache with malicious code. The next time the maintainer's legitimate pipeline runs, it loads the poisoned cache.

2. OIDC token theft

Modern npm pipelines use OIDC (OpenID Connect) to publish packages without storing permanent tokens — a mechanism designed precisely to be more secure. Mini Shai-Hulud extracts the ephemeral OIDC token directly from process memory (/proc) during the compromised pipeline execution, before it expires.

3. Self-propagation

With the stolen OIDC token, the worm authenticates to the npm registry as the legitimate maintainer and identifies all packages that token has write access to. It injects the malicious payload into each one and publishes the infected versions. The TanStack attack compromised 84 artifacts in 6 minutes.

What the payload does once installed

When a developer runs npm install with an infected package, the payload executes in the preinstall phase — before any test or security scanner can intervene. From there:

• Steals credentials: GitHub tokens, npm tokens, GitHub Actions secrets, AWS/Azure/GCP keys, pipeline environment variables.
• Exfiltrates to public repositories: stolen secrets are uploaded to GitHub repositories automatically created under the victim's account, exposing them publicly. It also uses filev2.getsession.org and api.masscan.cloud as alternative endpoints.
• Installs a persistent backdoor: on macOS and Linux systems it installs a daemon called gh-token-monitor (as a LaunchAgent or systemd service) that checks every 60 seconds whether stolen tokens have been revoked.
• Destructive failsafe: if it detects a token has been revoked, the daemon executes rm -rf ~/ to wipe the user's home directory before self-terminating.

Affected packages — May 2026 wave

The scale of the May 11 wave was unprecedented. Among the compromised ecosystems:

• TanStack — 42 packages, 84 malicious versions in 6 minutes.
• Mistral AI — packages from the official AI model library.
• UiPath — enterprise RPA automation tools.
• OpenSearch — AWS search and analytics engine.
• @antv — data visualization ecosystem with ~16 million weekly downloads, compromised on May 19 in a 22-minute automated burst.
• Zapier, PostHog, Postman — widely used automation and integration tools in development.

In total, over 170 npm packages and 2 PyPI packages in the May 11 wave, plus 323 additional packages from the @antv ecosystem on May 19.

Why traditional defenses fail to detect it

Mini Shai-Hulud introduces a technical innovation that makes it especially difficult to detect: it uses npm's legitimate security infrastructure to sign malicious code.

The SLSA (Supply-chain Levels for Software Artifacts) standard allows verifying that a package was built by a legitimate pipeline through provenance attestations signed with Sigstore. Mini Shai-Hulud steals the OIDC tokens that pipeline uses to sign, and uses them to produce valid Build Level 3 attestations for malicious versions. The command npm audit signatures returns a valid signature for compromised code.

In StepSecurity's words: "valid provenance does not guarantee safety" — valid provenance does not guarantee security if the pipeline that generated it was compromised.

Attack timeline

How to tell if you have been affected

If your project installed any of the compromised packages during the attack windows, assume exposure. Immediate steps:

1. Audit GitHub Actions runs after May 11, 2026 at 19:20 UTC. Look for unexpected npm publish events and outbound connections to filev2.getsession.org or api.masscan.cloud.
2. Review npm tokens: run npm token list and revoke any tokens you do not recognize.
3. Rotate all pipeline secrets: GitHub tokens, cloud keys (AWS, Azure, GCP), CI/CD environment variables.
4. Check for downstream propagation: if your pipeline published packages during a run that installed compromised versions, those published versions may also be infected.
5. Look for the gh-token-monitor daemon: on macOS check LaunchAgents (~/Library/LaunchAgents/), on Linux check user systemd services.
6. Verify automatically created public repositories under your GitHub account with suspicious names — the worm creates repositories to exfiltrate secrets.

Why this matters beyond npm

Shai-Hulud represents a paradigm shift in supply chain attacks. Previous attacks required the attacker to manually compromise a specific package. Shai-Hulud fully automates propagation: a single entry point becomes dozens or hundreds of compromised packages in minutes, using the legitimate maintainers' own credentials and the ecosystem's official signing infrastructure.

As Unit 42 at Palo Alto Networks notes, the September 2025 incident "marked the end of the nuisance era of npm attacks and the beginning of a high-consequence threat landscape." The question is no longer whether the software supply chain can be weaponized at scale — the answer is yes. The question is how long it takes your organization to detect it.

Conclusion

The software supply chain is today one of the most efficient attack vectors available to a sophisticated threat actor. A compromised package with millions of weekly downloads is a malware distribution vector that no conventional phishing system can match in scale.

If you develop software with npm or PyPI, now is the time to review your pipeline: what permissions your publish tokens have, whether you have anomalous behavior monitoring in CI/CD, and whether your dependencies are pinned to verified hashes rather than version ranges.

Trust in a package cannot be based solely on who signs it today — it must be based on whether the process that built it was under control at the time of signing.

Sources: Microsoft Security Blog · Akamai Security Research · Snyk · StepSecurity · Unit 42 (Palo Alto Networks) · Picus Security · NHS England Digital — May 2026.

Forensic analysis: Oscar Orts · Judicial Computer Expert · ORTSLAB.ES