Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner

What it is

Shai-Hulud-2.0-Detector is a GitHub Actions workflow you drop into a repo to check for indicators of the Shai-Hulud npm supply-chain worm — both the November 24, 2025 "Shai-Hulud 2.0" wave and the August 4, 2026 "ChainDrop" wave (keyv@6.0.0 and the compromised keyv/cacheable/flat-cache/file-entry-cache maintainer). The repo also solicits community reports of newly compromised packages.

How it works

Setup is a single workflow file. Create .github/workflows/shai-hulud-check.yml triggered on push to main/master and on pull requests. Beyond the tool, the page documents concrete indicators an engineer can also grep for directly:

• Persistence artifacts: .claude/settings.json SessionStart hooks and .vscode/tasks.json folderOpen tasks, which re-execute the payload whenever Claude Code or VS Code opens the project.
• Droppers/payloads: preinstall running setup_bun.js (2.0) or node setup.mjs → Math_Symbol.js/math_init.js (ChainDrop, Base91 + PBKDF2 + AES-256-GCM obfuscation).
• C2 domains: npm-cache.com, later awqhnjewqjkl.icu, resolved via an Ethereum smart contract so they survive domain takedowns.
• CI/CD theft: a planted fake codeql_analysis.yml workflow that dumps toJSON(secrets), plus scraping of Runner.Worker process memory for OIDC tokens.
• Runner/repo markers: self-hosted runners named SHA1HULUD; exfiltration repos labeled "Shai-Hulud: Here We Go Again".

Preconditions / Affected

Repos that install the compromised packages via npm install, where a preinstall/postinstall lifecycle hook can run. ChainDrop specifically targeted the keyv/cacheable/flat-cache/file-entry-cache maintainer, plus packages tied to Deliveroo, Ornikar, OneReach, Picsart, Qlik and ServiceTitan.

What to do

Add the drop-in check:

name: Shai-Hulud 2.0 Security Check
on:
  push:
    branches: [main, master]
  pull_request:

(The page shows this header; complete the workflow from the repo's Quick Start.) Independent of the tool, audit repos for the persistence files, the fake codeql_analysis.yml, SHA1HULUD runners, and the C2 domains listed above.

Caveats

Note the destructive failsafe: the 2.0 worm wipes the home directory if authentication fails — investigate suspected infections in a disposable/isolated environment, not on a live workstation. The detector's own value depends on community package reports being current, so an unreported compromised package may not be flagged.