The notorious Shai-Hulud malware has resurfaced in one of the most aggressive software supply-chain attacks seen in the open-source ecosystem, compromising more than 1,000 npm packages and triggering a wave of over 27,000 malicious GitHub repositories in mere hours. The campaign abuses a fake Bun JavaScript runtime installer to siphon developer secrets and poison the broader Node.js ecosystem at unprecedented scale.
A rapidly escalating attack
The new wave emerged over the weekend, beginning with the publication of trojanized versions of well-known packages—including Zapier, ENS Domains, PostHog, and Postman—to the npm registry. Each malicious version embeds Shai-Hulud’s new payload, designed explicitly to extract developer environment variables and CI/CD secrets and then exfiltrate them to GitHub in encoded form.
When the malware first appeared in mid-September, Shai-Hulud compromised 187 packages. Today’s campaign has dwarfed that initial outbreak, showing signs of industrial-scale automation and rapid propagation.
Charlie Eriksen, a malware researcher at Aikido Security, was the first to flag the resurgence. What began as a set of 105 suspicious packages quickly ballooned to 492 packages, then surged past 1,000, as automated attacker pipelines continued to publish new variants at breakneck speed.
At the time of writing, GitHub searches return over 27,600 repositories containing data exfiltrated by the malware—most believed to belong to developers who unwittingly installed trojanized packages while logged into GitHub or CI systems.
Hundreds of maintainers compromised
Cloud security researchers at Wiz uncovered roughly 350 unique maintainer accounts involved, many of which appear to be legitimate maintainers whose credentials were hijacked.
They reported activity consistent with “1,000 new repositories being added every 30 minutes,” suggesting an automated propagation engine capable of scaling far beyond earlier Shai-Hulud variants.
Eriksen confirmed that these repositories were not created directly by the attackers but were the result of infected developers’ systems leaking their own GitHub credentials, which the malware then used to create or modify repos during attempted exfiltration.
A fake Bun runtime at the core
A technical breakdown from Step Security reveals that the malware’s latest evolution revolves around a weaponized fake Bun runtime, delivered through two files embedded within the compromised npm packages:
1. setup_bun.js — A disguised dropper
Presented as a harmless Bun installer, this script is the initial execution point. Once triggered, it deploys the primary payload with elevated stealth measures.
2. bun_environment.js — A 10MB obfuscated payload
The second component is unusually large—10 megabytes—and employs what Step Security calls “extreme obfuscation,” including:
-
A massive hex-encoded blob containing thousands of entries
-
Anti-analysis loops to frustrate sandboxing
-
Dynamically reconstructed strings to evade static detection
This file handles the bulk of the secret-stealing behavior and GitHub exfiltration routines.
Automated poisoning of the npm registry
Investigators believe attackers used automated systems to:
-
Download legitimate npm packages
-
Modify their
package.jsonfiles to embed malicious lifecycle scripts -
Upload the altered packages using compromised maintainer credentials
The result: a sprawling supply-chain attack that exploits both npm’s openness and the decentralized trust model of open-source maintainers.
Implications: A new era of supply-chain worms?
Unlike typical npm malware, Shai-Hulud behaves more like a worm, automatically:
-
Infecting packages
-
Stealing credentials
-
Publishing more malware
-
Propagating through developer environments
The new campaign suggests that threat actors increasingly target developer platforms as a high-leverage attack vector—where a single compromised environment can ripple through thousands of downstream applications.
Mitigation and what developers should do now
Security teams urge developers to:
-
Audit npm dependencies for unexpected updates or versions published over the weekend
-
Rotate GitHub, npm, and CI/CD tokens immediately
-
Scan for indicators of compromise associated with Shai-Hulud
-
Consider isolating build environments until the scope of impact becomes clearer
Given the scale and speed of the attack, additional waves may still be ongoing.
Official sources:
