Shai-Hulud 2.0: How to Secure Your Software Supply Chain Against the Second Wave

• Self-propagating worm: Shai-Hulud 2.0 steals GitHub credentials, repackages itself, and republishes across a maintainer’s entire npm portfolio.

• Massive spread: 700+ infected npm packages, 25,000+ GitHub repos, 500 maintainers affected; 1,000+ new repos added every 30 minutes (Wiz).

• Cross-ecosystem impact: Also observed in Maven/Java via automated npm-to-Maven mirroring.

• Key risks: CI/CD exposure, compromised secrets, install-time execution, and poisoned registries.

• Defense: SBOM accuracy, provenance verification, runtime monitoring, and strict token/secret hygiene.

The scale and speed of Shai-Hulud 2.0’s spread have surpassed anything seen in recent supply-chain incidents. What began as a targeted npm compromise quickly escalated into a systemic, cross-platform infection affecting thousands of projects and hundreds of maintainers.

Unlike typical npm malware, which usually involves a single trojanized package, Shai-Hulud 2.0 behaves like a worm. After compromising a developer, it steals GitHub credentials, repackages itself, and republishes across the maintainer’s entire package set, turning each victim into a new distribution point. The result is rapid, exponential spread across the ecosystem.

Hundreds of npm packages have been compromised. These include high-visibility projects maintained by well-established organizations, amplifying downstream exposure.

The worm has been observed generating 1,000+S new malicious GitHub repositories every 30 minutes (Wiz), fueled by automated publishing from stolen credentials. Each new victim becomes a propagation node, multiplying the total impact every cycle.

The credential theft component of Shai-Hulud 2.0 is proving especially damaging. Verified leaked secrets include more than 1,500 credentials and tokens spanning major platforms – GitHub, AWS, Google Cloud Platform, and Azure.

This volume of sensitive tokens represents a broad, multi-cloud compromise with the potential for long-tail exploitation.

Fortunately, several high-profile maintainers such as Zapier, PostHog, and Postman have already regained control of their packages. The malicious versions have been removed from npm, and many affected repos are being reclaimed or cleaned.

However, the incident is still evolving. Even with rapid remediation, organizations must continue to monitor dependency health, CI pipelines, and GitHub accounts for signs of further credential leakage or automated republishing.

Notably, this wave has also impacted other ecosystems such as Maven/Java through automated npm-to-Maven artifact conversion (JFrog) .

• While npm remains the primary target of Shai-Hulud 2.0, this wave has demonstrated the risk of cross-ecosystem propagation, specifically into Java/Maven projects. Security researchers identified the malicious Maven artifact:
  • org.mvnpm:posthog-node:4.18.1 which contains the same payload (setup_bun.js and bun_environment.js) found in compromised npm packages (The Hacker News) .
• Mechanism: Automated bridging tools rebuild npm packages as Maven artifacts for Java projects. Teams not directly using Node.js may be exposed if their projects rely on these mirrored artifacts.

This demonstrates the ecosystem-agnostic risk of supply-chain attacks. Even projects that don’t directly use npm can inherit risk through automated tooling.

PostHog’s breach demonstrates the subtlety of CI/CD exposure:

• Malicious pull requests leveraged pull_request_target in GitHub Actions.

• A bot PAT was exfiltrated, which then allowed publishing of trojanized npm SDKs.

CI/CD workflows, even automated ones, are high-risk attack surfaces. Restrict scripts, minimize token exposure, and enforce short-lived credentials.

• Dependency pinning may fail due to transitive dependencies.

• Static SCA scanners cannot detect newly published, trojanized code under legitimate package names.

• Token misuse via CI/CD pipelines means even internal repos are at risk.

SBOM and supply chain tools can provide:

1. Dependency transparency: Tracks direct and transitive dependencies with version and maintainer metadata.
2. Provenance verification: Identifies unexpected package changes or unknown maintainers.
3. Credential and secret monitoring: Detects exfiltration attempts or misused tokens.
4. Behavioral insights: Monitors resource access or unusual execution patterns during installs.

While not a silver bullet, combining SBOM with continuous monitoring strengthens defenses against worm-like attacks.

OPSWAT SBOM technology scans source code repository and detects the malicious npm sha1-hulud package.

1. Rotate credentials: GitHub PATs, npm tokens, SSH keys, cloud credentials; enable MFA.
2. Remove compromised packages: Clear npm cache, node_modules, and pin to known clean versions.
3. Audit GitHub and CI/CD: Look for new repos, workflows, and suspicious commits.
4. Harden pipelines: restrict lifecycle scripts, limit outbound network access, and minimize token scope.
5. Continuous monitoring: Treat dependencies and build pipelines as part of the critical attack surface.

Shai-Hulud 2.0’s spillover into Maven/Java via npm-to-Maven bridging shows that supply-chain attacks can cross language and ecosystem boundaries. Even projects that don’t directly use npm may be exposed if automated bridging tools are used.

Stolen tokens (GitHub, npm, cloud) enable propagation and access to sensitive environments. Use short-lived, scoped tokens, enforce MFA, and rotate credentials immediately after any suspicion of compromise. Use automated secret scanning tools to accelerate the process.