Shai-Hulud 2.0 Still Spreading as Researchers Detail Victims and Exposed Secrets

Summary

Wiz reports continued, slower Shai-Hulud 2.0 spread, with a December 1 spike. Analysis of more than 30,000 repositories found exposed credentials, including still-valid npm tokens, and infections across npm, OpenVSX, and Maven.

Key points

Wiz observed continued spread at a lower pace, followed by a spike of more than 200 new repositories in just over 12 hours on December 1, 2025.
Analysis of about 24,000 environment files suggested only 23% of infections occurred on developer machines; most affected systems were Linux, often containers.
The @postman/tunnel-agent-0.6.7 and @asyncapi/specs-6.8.3 packages accounted for over 60% of infections. In 99% of instances, infection came from the npm preinstall event running node setup_bun.js.
The attack also affected an AsyncAPI IDE extension and a Maven package. Wiz reported no active worm spread in OpenVSX or Maven at the time of its analysis.
Wiz says exfiltrated victim data could appear in repositories belonging to unaffiliated GitHub users, complicating efforts to identify affected organizations.
Although the leaked-secret data was noisy, Wiz reported hundreds of valid credentials and said over 60% of leaked npm tokens remained valid.
Wiz found that the cloud.json file intended to hold harvested cloud secrets was unpopulated; it theorized that API failures could disrupt the extraction process.

Article Details

Event Type: Ongoing software supply-chain worm incident involving malicious packages and an IDE extension.
Impact: Shai-Hulud 2.0 continued to spread, with a spike of more than 200 new repositories in just over 12 hours on December 1, 2025. The incident compromised GitHub accounts and exposed credentials and other secrets across hundreds of companies. The article reports that more than 60% of leaked npm tokens were still valid. The attack also affected npm and Maven releases and involved a poisoned AsyncAPI IDE extension; no active spread was observed in the Maven or OpenVSX ecosystems.

Malware

Shai-Hulud 2Wiz Research and Wiz CIRT have been responding to the Shai-Hulud 2.0 incident (aka Sha1-Hulud) since news first broke on November 24, 2025. As of now we’re continuing to observe active spread, albeit at a significantly

Products

GitHub ActionsVictim containerization typeSpecifically on CI/CD runners, GitHub Actions is the leading platform with Jenkins, GitLab CI, and AWS CodeBuild coming distant second, third, and fourth:npmPace of the new public repositoriesThe dramatic drop across 11/24 reflects the containment activities by PostHog, Postman, AsyncAPI, and the npm team. Extracting from their respective reports:OpenVSXAsyncAPI disclosed that the initial attack has managed to exfiltrate not only NPM token but also an OpenVSX API key. Moreover, there are confirmed reports of successful infections from the poisoned AsyncAPI IDE

Tools

TruffleHogfor instance CI/CD runs might publish identical data across the exposure window. The attacker's use of Trufflehog means there are many unverified secrets in the data that are being used to drive FUD from some camps.