# Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware

Malicious npm package versions ran a post-install script that harvested secrets via TruffleHog and IMDS, exfiltrated them to GitHub, and self-propagated using stolen npm tokens.

- Payout: Real-world hack
- Severity: critical
- Program: npm
- Analysis by: Wiz Research
- Disclosed: 2025-09-16
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-npm-supply-chain-attack
- Tags: area:oss domain:oss impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:github-actions tech:nodejs technique:chained vuln:secrets-leak

**Target:** npm packages / developer CI environments and GitHub repos
**Root cause:** Compromised npm maintainer tokens (downstream of s1ngularity/Nx) allowed publishing malicious package versions whose post-install script runs TruffleHog and env/IMDS harvesting, then abuses any discovered GitHub/npm tokens to exfiltrate secrets and republish further malicious packages.
**Steps:**
1. Install a malicious version (e.g. `@ctrl/tinycolor@4.1.1`) so the post-install script executes.
2. Script runs TruffleHog plus environment variable and IMDS credential harvesting.
3. With a GitHub token, it creates a public repo `Shai-Hulud` containing `data.json` (double-base64 encoded secrets).
4. It pushes a GitHub Actions workflow to accessible repos exfiltrating secrets to `https://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7`.
5. It drops `/tmp/migrate-repos.sh` to clone private repos and republish them public with `-migration` suffix and description `Shai-Hulud Migration`.
6. With npm tokens found, it auto-publishes malicious versions of any packages it can access, propagating the worm.
**How found:** Wiz Research observed malicious package publications on npm and traced victimology to the s1ngularity/Nx compromise; analyzed payload scripts (/tmp/processor.sh, /tmp/migrate-repos.sh) and GitHub events (CreateEvent then PublicEvent) to reconstruct the worm.
**Exploitation:** Attacker leveraged stolen npm/GitHub tokens from the earlier s1ngularity/Nx compromise to publish trojanized versions of dozens of popular packages. On install, the payload harvested secrets, dumped them to attacker GitHub repos, injected exfiltrating Actions workflows, force-published private repos, and used any npm tokens to poison more packages.
**Escalation:** Worm behavior: each victim's npm tokens enable publishing malicious versions of additional packages, spreading across the ecosystem; GitHub tokens enable repo migration and workflow injection.
**Insight:** Post-install scripts in npm packages run with full developer/CI privileges; watch for CreateEvent immediately followed by PublicEvent on repos and for new branches named after the campaign, since deleted branches/commits aren't indexed by GitHub search.