Log in Request a demo

Malware profile

Shai-Hulud

Also known as Shai-Hulud 2.0

Shai-Hulud is a self-replicating worm that spreads through npm packages and code repositories.

In short

Shai-Hulud is a self-replicating worm that spreads through npm packages and code repositories. It steals credentials and access tokens from developer and build accounts, then uses them to publish infected package versions. CISA reported over 500 npm packages compromised in September 2025.

Last updated 9 October 2026

Profile MapMalware
  1. Names2names in public reportsShai-Hulud · Shai-Hulud 2.0
  2. Techniques14ATT&CK techniques listedInitial Access · Execution · Privilege Escalation

In one minute

What it is
A self-replicating worm that spreads through npm packages and steals developer credentials.
What it does
Collects GitHub tokens and cloud keys, uploads them to a public GitHub repository, and publishes infected versions of other packages.
Who uses it
No group is named. MITRE lists no group for this software, and the CISA alert of 23 September 2025 does not attribute it to a named actor.
How it gets in
A compromised maintainer account on the npm registry, with a malicious install script added to a package, as GitHub describes.
What to do first
Rotate all developer credentials, turn on phishing-resistant MFA for GitHub and npm, and pin dependencies to versions from before 16 September 2025, as CISA advises.

What it does

The worm runs when an infected package is installed. It looks for tokens and keys on the machine, then uses them to push the same code into more packages that the victim account can publish.

GitHub describes a multi-wave campaign. The second wave, called Shai-Hulud 2.0, added destructive functionality and a stronger focus on build environments. CERT-EU describes the ChainDrop malware in the Keyv npm maintainer account takeover as based on Shai-Hulud.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
Shai-HuludMITRE ATT&CK software S9008 and the CISA alert of 23 September 2025[1, 2]
Shai-Hulud 2.0Name GitHub uses for the second wave of the campaign[4]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Initial Access

  • Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1195.001

    It publishes itself inside infected packages from compromised maintainer accounts so that it reaches other victims, and it changes versions of existing packages.[1, 2]

Execution

  • Poisoned Pipeline Execution T1677

    It uses GitHub Actions from stolen accounts to create a malicious workflow file in the repository.[1]

  • Command and Scripting Interpreter: JavaScript T1059.007

    It uses JavaScript run with node.js to write JSON output and run its scripts.[1]

Privilege Escalation

  • Event Triggered Execution: Installer Packages T1546.016

    It adds an npm install hook, such as postinstall or preinstall, so the code runs when a package is installed.[1, 3]

Credential Access

  • Steal Application Access Token T1528

    It steals access and API tokens from CI/CD tools and code repositories.[1, 2]

  • Unsecured Credentials: Credentials In Files T1552.001

    It reads environment variables, cloud credential files and npm and GitHub configuration files to collect secrets.[1]

  • Credentials from Password Stores: Cloud Secrets Management Stores T1555.006

    It collects secrets from AWS Secrets Manager, GCP Secret Manager and Azure Key Vault.[1]

Lateral Movement

  • Use Alternate Authentication Material: Application Access Token T1550.001

    It uses captured npm tokens to list and update packages, and stolen GitHub tokens to reach compromised accounts.[1]

Persistence

  • Account Manipulation T1098

    It changes private GitHub repositories to public.[1]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Code Repository T1567.001

    It creates a repository named Shai-Hulud under the victim account and commits a JSON dump of system data and secrets to it.[1, 2]

  • Exfiltration Over Web Service: Exfiltration Over Webhook T1567.004

    It sends repository secrets to webhook.site.[1, 2]

Stealth

  • Obfuscated Files or Information T1027

    It stores stolen secrets in GitHub Action logs with repeated base64 encoding.[1]

Command And Control

  • Ingress Tool Transfer T1105

    It downloads packages and the secrets-discovery tool TruffleHog to gather sensitive data.[1]

Impact

  • Data Destruction T1485

    It overwrites and deletes writable files in the victim home folder.[1]

How it spreads

Shai-Hulud spreads by installing malicious code in npm packages. When a package is installed, the code runs, collects tokens, and uses them to log in to the npm registry as the compromised developer and publish infected versions of other packages. GitHub also says the attacker can hold stolen tokens and start a new campaign weeks or months later.

Timeline

  1. September 2025

    First reported

    MITRE describes Shai-Hulud as a supply chain worm first reported in September 2025.[1]

  2. 14 September 2025

    GitHub is notified

    GitHub says it was notified of the Shai-Hulud attack, a worm spreading through compromised npm maintainer accounts.[3]

  3. 22 September 2025

    GitHub removes packages and sets a plan

    GitHub says it removed over 500 compromised packages and blocked uploads of packages containing the malware indicators. It also announced changes to npm publishing.[3]

  4. 23 September 2025

    CISA alert

    CISA released an alert on the supply chain compromise, reporting over 500 compromised packages and giving recommendations.[2]

  5. 23 December 2025

    GitHub review of the waves

    GitHub describes a multi-wave campaign and says the second wave, Shai-Hulud 2.0, added destructive functionality and a focus on build environments.[4]

Detection and defense

  1. Review dependencies

    Review all software that uses npm, check package-lock.json and yarn.lock for affected packages including nested ones, and pin versions to releases from before 16 September 2025.[2]

    Counters: T1195.001

  2. Rotate credentials

    Rotate all developer credentials straight away, and revoke GitHub and OAuth apps that are not needed.[2, 4]

    Counters: T1528 T1550.001

  3. Require phishing-resistant MFA

    Require phishing-resistant multi-factor authentication on developer accounts, especially GitHub and npm, and give tokens an expiry date.[2, 4]

    Counters: T1550.001 T1098

  4. Watch the network

    Monitor firewall logs for odd connections and block outbound connections to webhook.site domains.[2]

    Counters: T1567.004

  5. Harden GitHub

    Audit repository webhooks and secrets, and turn on branch protection, secret scanning alerts and Dependabot security updates.[2, 4]

    Counters: T1677 T1567.001

  6. Publish safely

    Maintainers should use npm trusted publishing instead of tokens and check published packages against their source.[4]

    Counters: T1195.001 T1546.016

  7. Know the sources

    CISA lists no signatures in its alert. GitHub says npm blocks uploads that contain the malware indicators and keeps malware advisories in its Advisory Database.[2, 3, 4]

    Counters: T1195.001

Questions

What is Shai-Hulud?

MITRE describes it as a supply chain worm, first reported in September 2025, that spreads through code repositories including GitHub and npm packages.

How many packages did it hit in September 2025?

CISA reported that the worm compromised over 500 packages on the npm registry.

What does it steal?

CISA says it targeted GitHub personal access tokens and API keys for AWS, GCP and Azure.

Which group is behind it?

No source used here names a group. MITRE lists no group for Shai-Hulud.

How should I respond?

CISA advises a dependency review, pinning to versions from before 16 September 2025, rotating all developer credentials and requiring phishing-resistant MFA.

In our research

  1. TanStack worm: CI questions every team should ask October 2026
  2. The Rise of Supply Chain Cyber Attacks: How Vendor Trust Becomes the Way In July 2026
  3. Understanding Supply Chain Attack Tactics with Case Study October 2025
  4. TeamPCP Threat group
  5. Technology and SaaS Industry
  6. Malicious package Glossary term

Sources

  1. Shai-Hulud, Software S9008 MITRE ATT&CKSupports: Description, platforms and techniques of Shai-Hulud
  2. Widespread Supply Chain Compromise Impacting npm Ecosystem CISASupports: Over 500 packages compromised, what the worm did, recommended actions
  3. Our plan for a more secure npm supply chain GitHub (npm registry operator)Supports: GitHub notified on 14 September 2025, packages removed, npm publishing changes
  4. Strengthening supply chain security: Preparing for the next malware campaign GitHub (npm registry operator)Supports: The multi-wave campaign, Shai-Hulud 2.0 and maintainer advice

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

TeamPCP

The US FBI (July 2026) describes TeamPCP as a cyber criminal group behind large-scale software supply chain compromises of widely used developer and security tools. Australian and US authorities announced arrests and an indictment linked to the group in August 2026, and MITRE ATT&CK describes it as active since at least September 2025.

Read more

Industry

Technology and SaaS

Hijacked build tools, poisoned packages, stolen developer logins and leaked keys at software companies, and the rules that apply.

Read more