# Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets

Shai-Hulud 2.0 npm supply-chain worm trojanized ~700 packages via preinstall scripts, stealing cloud/CI secrets and exfiltrating to GitHub repos, compromising 25K+ repos.

- Payout: Real-world hack
- Severity: critical
- Program: npm ecosystem
- Credited: Wiz Research
- Disclosed: 2025-11-24
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack
- Tags: domain:oss impact:data-leak impact:privesc kind:incident platform:threat-intel sev:critical technique:recon technique:source-review vuln:secrets-leak

**Target:** npm packages and CI/CD pipelines
**Root cause:** Compromised maintainer accounts published trojanized package versions with preinstall lifecycle scripts that execute credential theft and exfiltration code during installation.
**Steps:**
1. Compromise npm maintainer accounts and publish malicious versions of legitimate packages.
2. Malicious package includes preinstall script that runs `setup_bun.js` and `bun_environment.js`.
3. Script harvests credentials from `~/.aws/credentials`, `~/.azure/`, env vars, and cloud IMDS.
4. Exfiltrates stolen secrets to GitHub repos with 'Shai-Hulud' in description via GitHub API.
5. Creates `.github/workflows/discussion.yaml` backdoor workflow on self-hosted runner named 'SHA1HULUD'.
6. Creates `.github/workflows/formatter_123456789.yml` to dump GitHub secrets as artifact, then deletes branch.
7. Attempts Docker breakout: `docker run --rm --privileged -v /:/host ubuntu bash -c "cp /host/tmp/runner /host/etc/sudoers.d/runner"`.
**How found:** Wiz Threat Research monitored npm package publications and GitHub activity, identified anomalous preinstall scripts and exfiltration repos, then reverse-engineered payload to discover credential harvesting and backdoor workflows.
**Exploitation:** Attackers used stolen GitHub tokens and cloud credentials (AWS AKIA, GCP, Azure) to access private repos, dump secrets from AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault, and escalate privileges via IAM policy manipulation. Cross-victim exfiltration published one victim's secrets in another victim's repos.
**Escalation:** Chained credential theft across CI/CD and developer machines, leading to cloud privilege escalation, container breakout, and persistent backdoor via self-hosted runner workflow.
**Insight:** Monitor for unexpected preinstall/postinstall scripts in dependencies and audit GitHub workflows for self-hosted runner registrations; cross-victim exfiltration means stolen secrets may appear in unrelated accounts.