Shai-Hulud Attacks Drove npm Trusted Publishing Adoption, but CI Risks Remain
Summary
The article links major npm supply-chain attacks to increased Trusted Publishing adoption, while noting that CI compromise can still expose OIDC credentials and that most top packages remain on long-lived tokens.
Key points
- Trusted Publishing replaces long-lived npm API tokens with short-lived credentials issued through OpenID Connect (OIDC).
- The article reports 11,001 of the top 51,370 npm packages adopted Trusted Publishing, representing about 25% of download volume; it says 40,369 packages still use long-lived tokens.
- Weekly adoption reportedly rose from a historical average of roughly 35–40 packages to a peak of 430 after successive supply-chain attack waves.
- The article describes attacks evolving from phishing and stolen tokens to CI workflow abuse, including poisoned GitHub Actions caches used to extract OIDC tokens from runner memory.
- It says malicious packages could carry valid SLSA Build Level 3 provenance even when attacker-controlled code compromised the build process.
- The article says later Miasma/Hades waves abused the OIDC publishing endpoint directly, illustrating that Trusted Publishing does not prevent every publishing-path attack.
- Its recommendations include adopting Trusted Publishing and hardening GitHub Actions workflows, especially pull_request_target workflows and their trust boundaries.
Article Details
- Topic
- The article examines how npm supply-chain attacks drove adoption of Trusted Publishing and how later attacks exploited CI pipelines and OIDC credentials.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | npmjs[.]help | Domain used to send a fake npm support email that phished a maintainer and harvested credentials and a live TOTP code. |
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainAttackers published backdoored packages and malicious versions through compromised package-publishing workflows.T1528 · Steal Application Access TokenIn the Mini Shai-Hulud II attack, attacker-controlled code extracted an OIDC token from runner memory and exchanged it through npm's token endpoint.T1546.004 · Unix Shell Configuration ModificationS1ngularity injected a shutdown command into the shell profile.
Threat Actors
Sapphire SleetThe article attributes the compromise of an Axios maintainer account and publication of backdoored versions to Sapphire Sleet.TeamPCPThe article attributes the CanisterWorm and CanisterSprawl attacks and the Mini Shai-Hulud campaigns to TeamPCP.UnknownWonderer1The account name the article says the Shai-Hulud 2.0 attacker adopted on GitHub; the operator's identity and the article's interpretation of the name are unverified.
Malware
CanisterSprawlApril 8–22, 2026: CanisterSprawl. A second TeamPCP npm worm using a new ICP canister. When PyPI tokens were discovered in infected environments, it jumped ecosystems via .pth injection. That week: 163 new packages.CanisterWormMarch 20–21, 2026: CanisterWorm. TeamPCP deployed an npm worm via stolen tokens. 28+ packages infected in under 60 seconds; the payload harvested credentials and self-propagated. That week: 112 new packages.kitty-monitor639 @antv npm versions were poisoned via a stolen maintainer account, each installing a persistent kitty-monitor backdoor. That week: 144 new packages. The week after: 430. An all-time high.s1ngularityAugust 26, 2025: S1ngularity. Attackers exploited a GitHub Actions misconfiguration in the Nx monorepo to execute code from a malicious fork in the upstream repo's trusted context, stealing the npm publishing token.Shai-HuludThen Shai-Hulud hit. Weekly adoption jumped to 430 packages. In 18 months, cumulative adoption grew 3.4x. We're still only at 25% of total download volume covered, just 11,001 of the top 51,370 packages have adopted it.
Vendors
CircleCIstolen CI credentials. A cross-ecosystem attack hit npm, PyPI, and Packagist in 24 hours via compromised CircleCI tokens. That week: 121 new packages.GitHubwith short-lived, per-run credentials issued via OpenID Connect. Instead of storing NPM_TOKEN in your GitHub repo secrets indefinitely, your CI pipeline gets a token that expires in minutes. Nothing to steal.npmnpm launched Package Provenance in late 2022. For two years, adoption averaged 20-50 packages per week. Followed by Trusted Publishing in 2024. Blog posts were written. CISA advisories were issued. The line barelyRed HatMiasma / Hades. The attack class shifted again. Wave 1 published 90 malicious npm versions targeting Red Hat Cloud Services packages — not by stealing OIDC tokens, but by abusing the OIDC publishing endpoint
Products
GitHub ActionsAugust 26, 2025: S1ngularity. Attackers exploited a GitHub Actions misconfiguration in the Nx monorepo to execute code from a malicious fork in the upstream repo's trusted context, stealing the npm publishing token.OpenVSXexfiltrated the CI token in under three minutes, then used it to deploy the worm via a malicious OpenVSX extension. The campaign spread to 25,000+ malicious repositories. Microsoft published guidance onPackagistTeamPCP pivoted from token theft to stolen CI credentials. A cross-ecosystem attack hit npm, PyPI, and Packagist in 24 hours via compromised CircleCI tokens. That week: 121 new packages.PyPIApril 8–22, 2026: CanisterSprawl. A second TeamPCP npm worm using a new ICP canister. When PyPI tokens were discovered in infected environments, it jumped ecosystems via .pth injection. That week: 163 new packages.Trusted PublishingProvenance in late 2022. For two years, adoption averaged 20-50 packages per week. Followed by Trusted Publishing in 2024. Blog posts were written. CISA advisories were issued. The line barely moved. Eventually