Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub 🔗 **Source:** [Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub](https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/) > [!note]+ Document Notes > ```markdown > > --- > tags: [security, supply-chain-attack, npm] > author: Bill Toulas > source: BleepingComputer > reference: [https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/] > date created: 2025-11-26 00:00 > > --- > > # 🏷️ Title: Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened. - A Shai-Hulud malware campaign trojanized hundreds (ultimately tens of thousands) of npm packages, exfiltrating developer and CI/CD secrets and auto-publishing them to GitHub. - Why it matters. - It’s a large-scale software supply-chain compromise targeting widely used libraries (Zapier, ENS Domains, PostHog, etc.), exposing tokens, credentials, and cloud secrets. - Key stakeholders. - JavaScript/Node developers, CI/CD operators, npm and GitHub, affected vendors (Zapier, ENS, PostHog, AsyncAPI), security teams. - Risks and tradeoffs. - Credential theft, cloud account takeover, code-signing key leaks, reputational damage; tradeoff between ecosystem openness and tighter publishing controls. - Bottom line. - Treat npm dependencies as untrusted, urgently rotate secrets if affected, and harden CI/CD pipelines (script restrictions, SBOMs, package pinning). ## 📖 Main Content - The article describes a renewed Shai-Hulud campaign that initially infected ~187 npm packages and grew to over 500 known trojanized packages, then more than 27,000 malicious packages via compromised maintainer accounts. - Attackers download legitimate packages, modify `package.json` to run a malicious pre-install script, then republish under compromised or fake maintainers. - The payload: - Uses a dropper (`setup_bun.js`) masquerading as a Bun installer and a heavily obfuscated `bun_environment.js` (~10 MB). - Gathers developer and CI/CD secrets and writes JSON files (`cloud.json`, `contents.json`, `environment.json`, `truffleSecrets.json`). - Pushes data to attacker-controlled GitHub repos with descriptions like “Sha1-Hulud: The Second Coming.” - Stolen secrets appear in thousands of GitHub repositories, indicating real-world compromise wherever affected npm packages were installed. - npm now shows warnings for some compromised packages (e.g., Zapier toolkits, ENS Domains libraries, PostHog, AsyncAPI), but all are still downloadable. - Recommended mitigations: - Use Aikido’s list of infected packages; downgrade to known-safe versions. - Rotate all secrets (npm, GitHub, cloud providers, CI/CD tokens). - Disable npm postinstall/preinstall scripts in CI where possible. - Improve supply-chain defenses while GitHub gradually rolls out additional npm security controls. ### 🗒️ Notes - Shai-Hulud is a supply-chain malware family targeting npm, focused on secrets exfiltration from developer and CI/CD environments. - Initial wave (mid-September): - ~187 packages compromised. - Used TruffleHog to scan for secrets. - Propagated via automatically republished packages with injected scripts. - New wave: - “Hundreds” quickly became ~492 known trojanized packages, then over 27,000 malicious packages observed. - ~350 unique maintainer accounts abused. - Around 1,000 new GitHub repositories per 30 minutes were being created during peak. - Payload details: - `setup_bun.js`: disguised as Bun installer; acts as dropper. - `bun_environment.js`: large, extremely obfuscated; uses hex-encoded strings, anti-analysis loops, and obfuscated string retrieval. - Executes at `preinstall`, before the rest of dependency installation. - Writes: - `cloud.json` (cloud-related secrets/config) - `contents.json` (possibly inventory of files/paths) - `environment.json` (env variables, tokens) - `truffleSecrets.json` (output resembling TruffleHog-like findings). - Exfiltration path: - Auto-generated GitHub repos with Shai-Hulud references in names/descriptions. - Attackers may control or have compromised GitHub accounts used to host these repos. - GitHub is actively deleting such repos, but attackers recreate new ones rapidly. - Impacted packages: - Zapier official toolkit for integration development. - ENS Domains libraries used by wallets, DApps, exchanges, and ENS Manager. - PostHog analytics-related packages. - AsyncAPI-related packages. - Platform responses: - npm flags certain versions with warnings about unauthorized publication. - GitHub is incrementally rolling out enhanced npm ecosystem security controls. - Defensive guidance: - Inventory dependencies and versions; compare against public lists (Aikido, Wiz, Step Security). - Pin and verify versions (lockfiles, hashes). - Rotate all tokens/keys that may have been exposed in CI or dev machines. - Restrict execution of lifecycle scripts (like `preinstall`, `postinstall`) in CI when possible. - Adopt secret-scanning and detection for leaked credentials (including GitHub and cloud provider tooling). ## 📚 References - BleepingComputer – Original article: https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/ - Aikido Security – Indicators and package lists (vendor blog, inferred from article). - Wiz – Research on scale of campaign and maintainer accounts (vendor blog). - Step Security – Technical analysis of `setup_bun.js` and `bun_environment.js`. - npm – Official registry and security advisories: https://www.npmjs.com/ - GitHub – Secret scanning and repository security documentation: https://docs.github.com/ ## 🗣️ Paraphrase - Paragraph A paraphrase. - A large Shai-Hulud malware operation has quietly slipped into the npm ecosystem, replacing legitimate popular packages with booby-trapped versions that steal developers’ secrets and push them into GitHub repositories. - Paragraph B paraphrase. - Security firms report that the campaign quickly exploded in size, leveraging hundreds of maintainer accounts and tens of thousands of malicious package versions, prompting urgent calls to downgrade affected dependencies and rotate all potentially exposed credentials. ## 📰 Newsletter In the broader open-source world, a new Shai-Hulud malware campaign is hammering the npm ecosystem, trojanizing widely used packages and exfiltrating CI/CD secrets to GitHub. For WordPress builders, the lesson is clear: treat every dependency—whether npm, Composer, or a WP plugin—as untrusted until verified. Now is a good time to: - Audit your build chain and deployment keys. - Lock and verify third-party assets (JS, CSS, vendor bundles). - Refresh your incident playbooks for leaked credentials. If you ship WordPress products that rely on npm, consider adding a short “supply-chain security” section to your docs and CI config examples, including lifecycle script controls and SBOM generation. Pair this with educational content for your users explaining how to validate checksums, review changelogs, and respond to dependency compromises. ## ✅ Action Items #### DevRel - Publish a short guide for developers on hardening npm- and Composer-based dependency chains in WordPress projects (themes, plugins, build tools). - Create example CI configs showing how to disable `preinstall/postinstall` scripts and validate package integrity. - Run an office-hours session or webinar on supply-chain threats relevant to plugin and agency teams. - Add a developer-focused blog post that maps npm-style attacks to the WordPress plugin/theme ecosystem. #### OSPO - Update open-source consumption policies to require dependency pinning, SBOMs, and periodic review of npm/Composer feeds. - Establish a standard procedure for rotating secrets when a supply-chain issue is detected. - Integrate automated license and security scanning into CI for all WordPress-related repos. - Maintain an inventory of critical third-party packages used across projects and their security posture. #### Community - Host a maintainer clinic on secure release practices, signing, and responding to compromised packages. - Offer “first supply-chain security issue” pairing sessions to onboard contributors to security processes. - Publish transparent incident-writeup templates for plugin/theme authors dealing with dependency compromises. #### WordPress - Core: reinforce dependency review for any external JS libraries; require documented security posture for new additions. - Core Performance: ensure performance tooling doesn’t rely on unvetted npm packages. - Core AI: document secure model and dependency sourcing, including npm dependencies in build stacks. - Core Program Team: add supply-chain security checkpoints to release and project checklists. - Mobile: review build pipelines and Gradle/npm dependencies for similar lifecycle-script risk. - Playground: sandbox and pin any external dependencies the Playground environment uses. - Community: add security/supply-chain modules to meetup and WordCamp starter kits. - Training: develop a short course on secure dependency management for WP developers. - Marketing: run a campaign highlighting “secure-by-default” practices in the WP ecosystem. - Support: add KB articles on responding to plugin/theme supply-chain alerts. - Design: ensure security warnings and update prompts in UIs are clear and prominent. - Documentation: document safe dependency practices (pinning, verifying, updating) in DevHub/HelpHub. - Photos/TV/Openverse: ensure ingestion and build pipelines follow similar security patterns. - Polyglots: localize security guidance so non-English communities get timely, clear information. - Accessibility/Meta/CLI/Hosting/Tide/Themes/Plugins: bake supply-chain checks, telemetry, and incident processes into their normal operations. #### The WPOCC - Offer microgrants or stipends for maintainers who invest in securing build pipelines and dependencies. - Run documentation sprints to capture “best practices for secure WordPress packaging.” - Pilot funding for cross-project incident drills and coordinated disclosure exercises. ### FAIR - Encourage technically independent verification of plugin/theme releases (hashes, signatures, reproducible builds where possible). - Promote transparent governance and funding disclosures for critical dependency maintainers. - Treat incident playbooks, charters, and cross-operator agreements as productized governance artifacts shared across the ecosystem. ## 🧪 Hypotheses - H1: Projects that disable npm lifecycle scripts in CI will experience significantly fewer successful supply-chain compromises. - H2: Regular credential rotation in CI/CD drastically limits blast radius from stolen secrets. - H3: Publishing official lists of compromised packages speeds remediation compared to ad hoc discovery. - H4: Ecosystems with enforced package signing and stricter maintainer authentication will see fewer large-scale campaigns like Shai-Hulud. ### 📊 Methodology - Compare incident rates between orgs that allow vs. block lifecycle scripts in CI, controlling for project size. - Analyze time-to-remediation across organizations before and after adopting curated feeds and public IOCs. - Study ecosystems (npm vs. others with stronger signing/enforcement) for frequency and scale of similar campaigns. - Survey developers on response behaviors after secret-leak notifications to measure the impact of guidance and tooling. ### ❓ Questions - How many organizations will discover they were compromised only via leaked GitHub repos? - What mix of ecosystem controls (signing, 2FA, automated review) most effectively reduces such attacks? - How can we make secret rotation low-friction enough that teams actually do it regularly? - Can reproducible builds or deterministic packaging meaningfully reduce this attack class? ### 🔮 Future Research - Evaluate the effectiveness of npm’s new security measures as they roll out. - Explore better tooling for detecting malicious `preinstall/postinstall` behavior at publish time. - Investigate how compromised maintainer accounts were initially obtained. - Develop open-source reference architectures for secure JavaScript build and release pipelines. ### 💡 Implications - Practice: teams must treat dependencies as untrusted code and harden CI/CD against malicious scripts. - Policy: ecosystems may need stricter maintainer identity verification and automated scanning. - Security: secret hygiene (least privilege, rotation, detection) becomes critical baseline practice. - Education: developers need practical, language-agnostic training on supply-chain risk. - Funding: critical open-source maintainers may require support to adopt stronger security practices and tooling. ### 🧠 Learning Styles Assessment - Reading level estimate: roughly Flesch-Kincaid Grade 10–11 (technical jargon plus vendor names/terms). #### 👀 Visual learners - Present: screenshots referenced (npm warnings, GitHub repos) but not deeply explanatory diagrams. - Improve: add diagrams of the attack chain (developer → npm → CI/CD → GitHub exfiltration). #### 🔊 Aural learners - Present: text only. - Improve: short audio summary or podcast-style breakdown of the incident. #### 🗣️ Verbal learners - Present: concrete technical descriptions and vendor quotes. - Improve: more analogies (e.g., “package as trojan horse”) and a small glossary of terms (CI/CD, exfiltration, etc.). #### 🧩 Kinesthetic learners - Present: high-level guidance (rotate secrets, disable scripts) but no hands-on steps. - Improve: step-by-step labs (e.g., “Run this script to list lifecycle hooks,” “Rotate a GitHub token”). #### 🧠 Logical learners - Present: causal chain (trojanized package → script → secrets → GitHub). - Improve: tables comparing mitigations, timelines, and decision trees for incident response. #### 🧑‍🤝‍🧑 Social learners - Present: references to multiple security vendors and community responses. - Improve: discussion prompts, incident debrief templates, and moderated Q&A spaces. #### 🧘‍♀️ Solitary learners - Present: article can be read and reflected on individually. - Improve: reflection questions (“How would our pipeline fare?”) and self-assessment checklists. #### 🌿 Naturalistic learners - Present: no environmental framing. - Improve: draw analogies with ecosystem health (e.g., invasive species as malicious packages). ### 📊 Accessibility Assessment #### Screen reader semantics - Present: standard news-article structure with headings and images. - Improve: ensure all security-related images have descriptive alt text and clear captions. #### Keyboard navigation - Present: typical web article; likely basic keyboard support. - Improve: guarantee visible focus states and skip-links to jump past navigation. #### Contrast and readability - Present: likely meets basic news-site contrast standards. - Improve: check text/background combinations for 4.5:1; ensure comfortable line spacing. #### Text resizing and reflow - Present: responsive design typical of news sites. - Improve: confirm that at 200% zoom, no clipping occurs and layout remains usable. #### Media and captions - Present: static images only. - Improve: if videos are ever embedded, provide captions and transcripts. #### Forms and interactions - Present: mostly article content; minimal forms. - Improve: ensure any sign-up or comment forms are fully labeled and keyboard-accessible. #### Standards reference - Map gaps against WCAG 2.2 AA for headings, contrast, reflow, and non-text content. ### 🌍 DEIB Assessment #### Cultural breadth - Present: global developer context but not region-specific. - Improve: mention how supply-chain risk affects diverse regions and infra types (SMEs, NGOs, gov). #### Inclusive language - Present: technical, neutral tone. - Improve: provide plain-language summaries for less technical readers. #### Neurodiversity support - Present: structured into sections and paragraphs. - Improve: more frequent headings, bullet lists for steps, and reduced dense paragraphs. #### Representation - Present: focused on organizations and tools, not individuals. - Improve: where images show people, ensure diverse representation and describe it in alt text. #### Psychological safety - Present: no shaming; focuses on facts and remediation. - Improve: explicitly frame compromise as systemic risk, not individual failure, and point to help. ### ✅ Logical Validity #### Strong reasoning - Causal reasoning: trojanized package → malicious script → secret exfiltration → GitHub repos, clearly described with vendor observations. - Inductive reasoning: scale of repos and accounts supports the claim that this is a large, ongoing campaign. #### Fallacies - None obvious; article is descriptive and cites security vendors rather than speculating wildly. #### Tone of voice - Calm, technical, security-reporting tone with occasional urgency around remediation and risk. ### 🛡️ DARVO Analysis - Deny: no denial or minimization by attackers or platforms is reported. - Attack: no attacks on accusers; vendors collaborate in disclosure. - Reverse victim/offender: not present; article treats affected developers as victims of a supply-chain campaign. ## 🎯 Conclusion The Shai-Hulud campaign shows how fragile software supply chains are: a few compromised npm accounts can spread secrets-stealing malware into widely trusted packages. Developers and organizations should immediately check for affected dependencies, rotate potentially exposed credentials, and harden CI/CD pipelines—especially around npm lifecycle scripts and secret management. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: **H3**. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] Shai-Hulud targets npm supply chain > [!quote] [Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub](https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/) by [[Bill Toulas]] via [[BleepingComputer]]. Published 2025-11-24. Accessed . > “Hundreds of trojanized versions of well-known packages … have been planted in the npm registry in a new Shai-Hulud supply-chain campaign.” Two lines: context and use. Cite data if relevant. [view highlight](https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] Campaign exfiltrates secrets to GitHub > [!quote] [Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub](https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/) > “The data is automatically posted on GitHub in encoded form.” Two lines: context and use. [view highlight](https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) - Purpose: Promote reusable claims into Atomic notes. - Split level: **H4**. - Each item: one idea, present tense, specific, testable. #### [Z1] Shai-Hulud malware weaponizes npm lifecycle scripts - Scope/condition in one line. - Pointer to page/time or dataset. - Links: [[Software-Supply-Chain]] [[npm-Security]] #### [Z2] Secret leaks manifest as GitHub repositories - Scope/condition in one line. - Pointer to page/time or dataset. - Links: [[Credential-Exposure]] [[GitHub-Security]] --- ### ✏️ Fleeting Queue (Extract by Selection) - Purpose: Capture quick actions or sparks for Fleeting notes. - Extraction: **Select one line** → “Refactor: Extract selection to new note (content only).” - Keep each line short and self-contained. - [F1] Audit CI pipelines for npm lifecycle script execution — context/https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/ #fleeting #inbox - [F2] Compile organizational inventory of high-risk npm dependencies — context/https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/ #fleeting #inbox - [F3] Draft incident playbook for leaked CI/CD secrets — context/https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/ #fleeting #inbox --- <!-- deep-read:sections end -->