Happy Birthday, Shai-Hulud

What it is

A Socket retrospective (Sarah Gooding) marking one year of the Shai-Hulud npm worm, which began September 2025 when an attacker published a malicious @ctrl/tinycolor (then ~2M weekly downloads) and self-propagated across dozens of packages, including into CrowdStrike's npm namespace. Beyond the timeline, the value here is the concrete evolution of the technique across waves and the attribution nuance the summary flattens.

How it works

The original payload was a bundle.js that ran TruffleHog (a legitimate secret scanner) to sweep hosts for npm tokens, GitHub credentials, and cloud keys. It exfiltrated to a hardcoded webhook and to a public GitHub repo it created on the victim's own account (named "Shai-Hulud"), planted a GitHub Actions workflow for persistence, then used stolen npm tokens to inject itself into the maintainer's other packages and republish them.

The technique escalated across waves — this progression is the actionable content:

• Nov 2025 ("The Second Coming"): moved execution to the pre-install step (widening blast radius into dev machines and CI), shipped setup_bun.js and bun_environment.js, and added a destructive fallback that could wipe the user's home directory.
• May 2026 (a "Mini Shai-Hulud" burst): pushed 400+ malicious versions across 172 packages in ~5 hours (TanStack, Mistral AI, UiPath, OpenSearch) with no stolen credential at all — by hijacking short-lived OIDC tokens from CI.

Preconditions / Affected

Maintainers with npm publish tokens or credentials reachable by install scripts; CI pipelines that expose OIDC tokens or run install scripts with publish rights. The pre-install shift means merely installing an affected version — not just running code — triggers the payload. Depending on npm packages at all put you in scope during active waves.

What to do

The page states no commands, but it names the recurring drill and the specific weak spots. Concrete leverage points it identifies:

• Install-script execution — pre-install/postinstall was the widening vector; disabling scripts blunts it.
• Token security and OIDC — the May wave needed no stored credential, only a hijackable short-lived CI OIDC token.
• Publishing workflow — the mechanism was maintainer republish via stolen tokens.
• Detection signal: attacker-created public GitHub repos on victim accounts and injected GitHub Actions workflows. The ongoing response pattern named is token rotations and lockfile audits after each wave.

Caveats

Attribution is explicitly muddy: the page argues arrest coverage conflated TeamPCP with the worm's original authors. TeamPCP adopted the Shai-Hulud name only for 2026 waves and open-sourced the framework in May 2026 (with a $1,000 Monero contest); the original Sept 2025 and Nov 2025 attacks were never definitively attributed to them. The two men arrested in Western Australia on Aug 26, 2026 (aged 21 and 23, per AFP/FBI) are alleged operators of later waves only. AFP estimates — 500,000+ credentials, 300GB+ data, remediation in the hundreds of millions across 1,000+ orgs — are attributed to the group's run, not the whole campaign. With the code public and forked, the author warns attribution "only gets harder."