Shai-Hulud 2.0 npm Campaign Steals Secrets and Spreads Across 25,000+ GitHub Repositories

Summary

Wiz reports a Shai-Hulud-linked npm campaign that trojanized roughly 700 packages, stole developer and cloud secrets, and spread data to 25,000+ GitHub repositories. GitHub revoked tokens and restricted malicious repositories; teams are urged to rotate credentials.

Key points

Trojanized npm packages ran malware during installation, with affected versions reported uploaded between November 21 and 23, 2025.
The malware stole developer, GitHub, and cloud credentials and exfiltrated secrets to GitHub repositories, sometimes under unrelated victims’ accounts.
Wiz reported more than 25,000 malicious repositories across roughly 500 GitHub users and identified 775 compromised GitHub tokens, 373 AWS credentials, and 300 GCP credentials in its reviewed sample.
The payload targeted AWS, Azure, and GCP secrets and attempted persistence and privilege escalation; it also installed a GitHub Actions backdoor, whose in-the-wild use had not been observed.
GitHub began revoking leaked tokens, privatizing malicious repositories, and notifying affected users; most malicious package versions had been removed by November 27, according to Wiz.
Wiz advised checking dependencies, replacing compromised versions, rotating credentials, auditing repositories and workflows, and restricting lifecycle scripts in CI/CD.

Article Details

Attack Vectors: Compromised npm maintainer accounts were used to publish trojanized package versions whose preinstall scripts executed during installation.
The malware collected credentials from local configuration files, environment variables, and cloud instance metadata services, then used authenticated sessions to access cloud secret stores.
Stolen secrets were exfiltrated to attacker-created GitHub repositories, including repositories owned by unrelated victims.
A GitHub Actions workflow on self-hosted runners was configured to execute commands supplied through repository discussions; Wiz reported validating this behavior in testing, but found no evidence it had been used in the wild.
The malware attempted a Docker container breakout by mounting the host filesystem in a privileged container and writing a sudoers file to grant passwordless root access.
Defensive Notes: Remove compromised packages, clear the npm cache and node_modules, and pin dependencies to known-clean versions or roll back to pre-November 21, 2025 builds.
Revoke and regenerate npm tokens, GitHub PATs, SSH keys, and cloud credentials; enforce phishing-resistant MFA for developer and CI/CD accounts.
Audit GitHub repositories and CI/CD environments for newly created repositories with Shai-Hulud descriptions, unauthorized workflows, suspicious commits referencing hulud, and unexpected npm publishes.
Restrict or disable lifecycle scripts in CI/CD, limit build-system outbound network access to trusted domains, and use short-lived, scoped automation tokens.

Indicators of compromise

Type	Indicator	Context
SHA1	`3d7570d14d34b0ba137d502f042b27b0f37a59fa`	SHA1 hash listed for the malicious bun_environment.js payload.
SHA1	`d1829b4708126dcc7bea7437c04d1f10eacd4a16`	SHA1 hash listed for the malicious setup_bun.js payload.
SHA1	`d60ec97eea19fffb4809bc35b91033b52490ca11`	SHA1 hash listed for the malicious bun_environment.js payload.