Loading malware…
Shai-Hulud is a self-replicating software supply-chain worm and credential-stealing malware family associated with attacks on developer ecosystems and CI/CD environments since at least 2025. It is widely linked to the TeamPCP threat cluster, although later copycat and lineage-related strains such as Miasma and Hades have also been described as part of the broader Shai-Hulud family. The malware has primarily targeted open-source package registries and trusted developer workflows, especially npm and PyPI, and has been observed compromising maintainer accounts, poisoning legitimate packages, and abusing victims’ own publishing rights to propagate further malicious releases.
Its core behavior centers on harvesting high-value secrets from developer workstations, build runners, and cloud-connected environments. Reported targets include source-control tokens, package-publishing credentials, cloud credentials, Kubernetes and Vault secrets, SSH material, cryptocurrency wallet data, and configuration secrets from IDEs and AI-assisted coding tools. Exfiltration has repeatedly relied on victim-controlled GitHub resources, including creation of public repositories and commits made with stolen tokens, reducing dependence on attacker-owned infrastructure and helping the malware blend into legitimate workflows.
Shai-Hulud exhibits worm-like propagation by using stolen maintainer or automation credentials to republish trojanized versions of other packages the victim can access. This allows it to spread laterally across package ecosystems and through CI/CD pipelines while bypassing protections such as two-factor authentication that are already satisfied by the victim’s authorized session or token. Multiple waves have shown execution during package installation or module use, including techniques that avoid obvious lifecycle-script indicators and instead abuse native build paths or other trusted execution points.
Later variants in the family have added persistence and destructive safeguards. Reported behaviors include attempts to persist through developer tooling and automation environments, monitoring stolen tokens for revocation, and in some cases triggering destructive actions if exfiltration or token validity checks fail. Some lineage-related variants have also been described as scraping secrets from GitHub Actions runner memory, creating malicious workflows to dump CI secrets, and attempting SSH-enabled lateral movement.
The malware family has disproportionately endangered organizations with modern cloud-native development practices, especially those relying on npm, PyPI, GitHub Actions, Jenkins, and other automated build and release systems. Victims and downstream exposure have included software vendors, cloud-connected enterprises, and cryptocurrency-related development environments. Shai-Hulud became a defining example of self-propagating open-source supply-chain malware because it weaponized trusted maintainer relationships and legitimate publishing pipelines rather than relying solely on conventional malware delivery infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-10894 highlights how a single workflow misconfiguration can cascade into widespread compromise across the JavaScript ecosystem. The attack chain for CVE-2025-10894 began with exploitation of a GitHub Actions workflow in the Nx repository. The workflow used the pull_request_target trigger, which grants elevated permissions (including a writable GITHUB_TOKEN) to workflows running on pull requests from forks. Attackers crafted pull requests with titles containing bash injection payloads. | The campaign escalated with the release of a self-replicating worm (Shai-Hulud) that used harvested npm credentials to infect additional packages, resulting in over 500 compromised npm projects.
Shai-Hulud is a self-propagating, info-stealing malware that infects software components, uses the access to publish poisoned versions, and then harvests the repository accounts of those affected by the malware downstream.
359 GitHub repos created with encrypted stolen credentials — “Shai-Hulud: Here We Go Again.” CVE-2026-45321 published CVSS 9.6 critical. Mitre, CISA, and major registry operators issue coordinated advisories. | Shai-Hulud is, at this point, a very familiar name... The most recent one being the so-called Mini Shai-Hulud... they are back again... compromising the TanStack Router packages, and starting a brand new campaign based on Mini Shai-Hulud.
In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Although the malware has some similarities to the Shai-Hulud and Miasma campaigns, and it contains the Miasma string multiple times inside its code, this malware isn't the same as them, nor is it attributed to the Miasma/Shai-Hulud/TeamPCP campaigns that we've seen in the past.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.
researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide.
A new wave of the Shai-Hulud supply chain campaign, adding 23 newly discovered malicious PyPI package-version artifacts to an already alarming operation that previously compromised 37 packages.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
When a developer installed an infected component, the malware not only stole their secrets, but also used their credentials to hijack other packages they maintained automatically, republishing them in infected form to spread further.
Subsequent investigation confirmed that this was a deliberate supply-chain compromise. The malicious code was introduced by a developer known as “Jia Tan”, who spent two years building trust within the project before planting a sophisticated backdoor.
On Windows, it used cmd.exe to delete the contents of the user's profile directory... On Linux and macOS, it located the user's writable files, overwrote them with the shred command
When a developer installed an infected component, the malware not only stole their secrets, but also used their credentials to hijack other packages they maintained automatically, republishing them in infected form to spread further.
Persistence - скрипт payload_1.sh устанавливает gh-token-monitor: на macOS через launchctl load
Отдельный модуль на Python читает /proc/<PID>/mem процесса Runner.Worker GitHub Actions, вытаскивая JSON-объекты с {"value":"...","isSecret":true}
When a developer installed an infected component, the malware not only stole their secrets, but also used their credentials to hijack other packages they maintained automatically, republishing them in infected form to spread further.
Defense Evasion (T1027, T1140). Payload обфусцирован в несколько слоёв: hex-кодирование строк, XOR-шифрование, AES-256-GCM, вложенные вызовы Function(atob(...)).
Отдельный модуль на Python читает /proc/<PID>/mem процесса Runner.Worker GitHub Actions, вытаскивая JSON-объекты с {"value":"...","isSecret":true}
harvesting more than 500,000 credentials from over 10,000 CI/CD pipelines, including cloud tokens, Kubernetes secrets, and GitHub and GitLab access tokens.
the malware not only stole their secrets... The attack exposed more than 1,500 sensitive secrets, including AWS, Azure, GCP and GitHub tokens
Shai-Hulud harvests GitHub and cloud service credentials from developer machines and CI environments, so compromising one employee was enough to reach Suno's internal systems.
Малварь перебирает файловую систему... конфигурации криптокошельков и AI-инструментов.
Rather than relying exclusively on traditional malware infrastructure, the attackers used GitHub repositories as dead-drop locations for stolen data. In some cases, more than 2,500 public repositories were reportedly created using compromised GitHub tokens for this purpose.
C2 и Exfiltration (T1104, T1041). Украденные данные шифруются и уходят через несколько каналов
213 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-replicating supply-chain worm that masquerades as legitimate packages, steals developer secrets, abuses stolen credentials to hijack additional maintained packages, and republishes them in infected form to propagate further across the open-source ecosystem.
Shai-Hulud is a worm that harvests GitHub and cloud service credentials from developer machines and CI environments, exfiltrates them to a public GitHub repository under the victim's own account, and spreads by republishing malicious versions of packages accessible through stolen npm and GitHub accounts. Later waves added destructive behavior that wipes home directories when exfiltration fails, and variants expanded to poison AI toolchains and target npm, PyPI, and Packagist.
Referenced as a prior campaign/malware with similarities to the analyzed payload, but explicitly stated to be distinct from the current malware.
A self-replicating npm worm that harvested developer secrets and republished itself using stolen tokens.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.