Wiz Traces Shai-Hulud’s Lingering Infections to Cached Packages and a Malicious IDE Extension
Summary
Wiz reports that cached packages and a malicious OpenVSX extension prolonged Shai-Hulud infections. A clean extension update sharply reduced new infections; leaked credentials remain, and a possible link to Trust Wallet’s $7 million theft is under investigation.
Key points
- Wiz says the worm persisted at roughly 100–200 new compromised repositories per day from November 25 to December 24, despite earlier containment.
- More than 90% of the reported long-tail infections were attributed to the malicious asyncapi-preview v1.0.1 OpenVSX extension; private registries and local caches accounted for about 5%.
- The extension remained installed because no higher version prompted IDEs to update it. AsyncAPI published a clean v1.1.0 on December 24, after which Wiz says new repositories fell to a handful per day.
- Wiz identified ongoing exposure of cloud, AI, SaaS, and developer-tool credentials in its dataset; it reported that more than 200 AI API keys remained valid as of December 28.
- Wiz says Trust Wallet’s leaked GitHub token and Chrome Web Store credentials could have enabled abuse of its browser-extension distribution pipeline. Trust Wallet later said it had high confidence the incident was likely related to Shai-Hulud; its investigation was ongoing.
- Wiz recommends syncing private registries with upstream revocations, auditing cached packages, avoiding offline cache use in high-stakes builds, rotating all exposed secrets, and publishing clean higher-versioned extensions when needed.
Article Details
- Attack Vectors
- Malicious npm packages persisted in private registries and local caches after they were revoked from the public npm registry.
- The malicious OpenVSX extension asyncapi-preview v1.0.1 remained installed because no higher version was available to trigger IDE auto-updates.
- The article reports that Shai-Hulud exfiltrated GitHub tokens, Chrome Web Store credentials, cloud credentials, AI API keys, and SaaS/dev-tool keys. Wiz Research said leaked Trust Wallet credentials provided viable paths to hijack its browser-extension distribution pipeline.
- Wiz Research identified a possible connection between the Shai-Hulud incident and the Trust Wallet browser-extension v2.68 theft; Trust Wallet later said it had high confidence the incident was likely related.
- Defensive Notes
- Configure private registry mirrors to frequently check upstream package metadata and promptly reflect package revocations.
- Audit pull-through caches for packages removed from public repositories.
- Avoid local caches that skip registry validation in high-stakes builds; clear npm, yarn, and pnpm caches and force clean builds when a supply-chain incident is suspected.
- Assess and rotate all exposed credentials, including cloud, AI, SaaS, and developer-tool keys, not only npm and GitHub tokens.
- When a malicious package or extension may remain installed, publish a clean higher-versioned release to trigger automatic updates.
MITRE ATT&CK
Malware
Products
asyncapi-previewThe OpenVSX "Zombie" Extension (90%+ of cases): The malicious asyncapi-preview v1.0.1 extension remained active on developer machines because no higher version existed to trigger an automatic update … until ournpmtwenty-five thousand repositories in the first day of the incident. While aggressive containment by the npm team and ecosystem partners triggered an immediate crash in new infections, the worm did not disappear.OpenVSXto "snip the tail." By coordinating with the AsyncAPI team to publish a clean version (v1.1.0) of their OpenVSX extension, we forced an update across the IDE ecosystem. The impact was immediate: by December 29th,Trust WalletThe Trust Wallet Link: Analyzing a $7M exploit’s potential connection to sha1-hulud.