Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs

What it is

Endor Labs' live incident blog on Shai-Hulud 2, the escalated npm supply-chain worm active from ~Nov 24, 2025. Beyond the mechanics the summary covers, the page carries the concrete IoC filenames, the secret-dumping workflow trick, and specific remediation steps an engineer can act on. As of 11/26 14:30 CET, 99% of affected package versions were removed from npm and no new malicious versions were published in the prior 24h; >26,000 repos with leaked credentials were findable via GitHub search.

How it works (details the summary omits)

• Exfiltration has no C2 domain and no malicious domains — stolen data is committed/pushed via the GitHub API into a newly created public repo. Credentials inside the IoC files are double Base64-encoded to defeat string-based detection.
• Secret-dumping via fake formatter workflow: for each accessible repo with secrets, the malware creates a branch named add-linter-workflow-<timestamp> and adds .github/workflows/formatter_123456789.yml (disguised as "Code Formatter"). It uses ${{ toJSON(secrets) }} to dump ALL repo secrets to format.json, uploads it as a workflow artifact, waits up to 30s, downloads the artifact, then deletes the branch and workflow run to cover tracks.
• Self-hosted runner backdoor installs to $HOME/.dev-env/; discussion.yaml (only created if the token has workflow scope) runs echo ${{ github.event.discussion.body }}, injecting discussion-body content into the shell.

Preconditions / Affected

Any environment installing a compromised package — laptops, build servers, GitHub Actions runners. Packages from Zapier, ENS Domains, Postman, PostHog among those compromised. The discussion.yaml backdoor requires a stolen GitHub token with workflow scope.

What to do

Detect — check repos/devices/build systems for new or modified preinstall scripts, unexpected Bun install/use, npm or GitHub accounts publishing without human action, and any IoC files: cloud.json, contents.json, environment.json, truffleSecrets.json, actionsSecrets.json, .github/workflows/discussion.yaml, .github/workflows/formatter_123456789.yml.

Contain — rotate all credentials (npm, GitHub, cloud, CI/CD); remove malicious repos; temporarily restrict repository creation in your GitHub account.

Harden —

• Require lockfiles in CI; use npm ci rather than npm install unless changing deps.
• Make --ignore-scripts the default (opt out, not in) to block lifecycle-hook execution.
• Apply cooldown / minimum-release-age (Dependabot cooldown, pnpm minimum release age); CIS benchmark suggests packages >60 days old.
• Run SCA/malware scanning in CI.

Caveats

Active incident; package list, infected-repo count, and attribution are still changing. Some TruffleHog findings (Aiven/TomorrowIO keys in node/bun binaries) are noted as likely false positives.