Shai-Hulud npm Worm Steals Secrets and Spreads by Publishing Malicious Packages
Summary
Wiz details how malicious npm packages stole secrets and used npm tokens to spread. Researchers found exposed credentials and publicized private repositories, and recommend removing affected versions, auditing GitHub, and rotating secrets.
Key points
- Malicious npm package versions published on September 15, 2025, ran a post-install payload that used TruffleHog, environment variables, and cloud metadata credentials to collect secrets.
- With GitHub tokens, the malware created public Shai-Hulud repositories, added workflows to exfiltrate repository secrets, and republished private organizational repositories as public.
- The worm could use npm tokens found in compromised environments to publish malicious versions of accessible packages, spreading across the npm ecosystem.
- Wiz reported 36 GitHub users with secrets exposed in Shai-Hulud repositories, eight users whose private repositories were made public, and 64 additional repositories with a malicious branch.
- The webhook endpoint was deactivated after excessive activity, but some secrets remained exposed in GitHub workflow logs; Wiz had not observed further repository creation at the time of writing.
- Wiz recommends removing malicious package versions, upgrading to clean releases, checking GitHub repositories and audit logs, monitoring developer systems and CI/CD, and rotating potentially exposed credentials.
Article Details
- Attack Vectors
- Compromised npm packages executed a post-install script that harvested secrets and environment variables, including cloud keys exposed through IMDS.
- The payload used TruffleHog to scan for secrets, then abused discovered GitHub tokens to create public repositories containing stolen data and push malicious GitHub Actions workflows.
- When it found additional npm tokens, the worm published malicious versions of packages accessible to those tokens, propagating through the npm ecosystem.
- The malware migrated private organizational repositories to public personal repositories under an attacker-controlled user, adding a -migration suffix.
- The workflow script at /tmp/processor.sh created a shai-hulud branch and triggered GitHub workflows; /tmp/migrate-repos.sh handled repository migration.
- Defensive Notes
- Remove malicious package versions, clear node_modules and the npm cache, and upgrade to clean releases.
- Audit developer accounts and repositories for public repositories named Shai-Hulud, shai-hulud branches, and migrated repositories with the Shai-Hulud Migration description and -migration suffix.
- Review GitHub audit logs for anomalous API usage and monitor developer endpoints and CI/CD pipelines for suspicious API calls and unexpected child processes.
- Revoke and regenerate potentially exposed GitHub and npm tokens, SSH keys, API keys, and environment-variable secrets.
- Treat Wiz's YARA-based detection of the malicious script as evidence of potential host compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09 | SHA256 hash identified in the article as a malicious JavaScript file. |
MITRE ATT&CK
T1059.004 · Unix ShellThe package's post-install payload and dropped shell scripts executed commands, including /tmp/processor.sh and /tmp/migrate-repos.sh.T1059.009 · Cloud APIThe malware pushed a GitHub Actions workflow to accessible repositories and triggered workflows to expose and exfiltrate repository secrets.T1098.004 · SSH Authorized KeysUsing stolen GitHub tokens, the malware added a workflow to accessible repositories.T1195.002 · Compromise Software Supply ChainMalicious versions of npm packages were published and executed through their post-install scripts.T1528 · Steal Application Access TokenThe worm searched for and validated GitHub tokens, then used them to access repositories and publish workflows.T1531 · Account Access RemovalThe malware changed private organizational repositories to public personal repositories controlled by the attacker.T1537 · Transfer Data to Cloud AccountThe malicious GitHub Action sent repository secrets to the webhook endpoint, and the malware published harvested secrets in public GitHub repositories.T1552.001 · Credentials In FilesThe payload harvested sensitive data, including secrets in environment variables and cloud keys exposed through IMDS.T1555 · Credentials from Password StoresThe payload used TruffleHog to scan for secrets in the compromised environment.
Malware
Products
GitHuba post-install script that harvested sensitive data and exfiltrated it to attacker-created public GitHub repos named Shai-Hulud. Beyond data theft, the malware exhibits worm-like behaviour: when a compromisedGitHub ActionsIt pushes a new GitHub Actions workflow to all accessible repositories.npmOn September 15, 2025, malicious versions of multiple popular packages were published to npm. They contained a post-install script that harvested sensitive data and exfiltrated it to attacker-created public GitHub repos