shai-hulud 2.0: npm worm leaks secrets to 25,000+ github repos
A second wave of the self-spreading npm worm ran at install time, stole developer and cloud credentials, published them to public GitHub repos, and could try to wipe home directories.
- ecosystem
- npm packages; GitHub repos and Actions runners
- scale
- 25,000+ malicious GitHub repos across ~350 users (Unit 42); ~700 compromised npm packages (Wiz)
- payload
- credential stealer with self-propagation, runner backdoor, home-directory wipe fallback
- exploited
- yes — active self-propagating campaign (Wiz, Unit 42)
what happened
- Wiz published its analysis on 24 November 2025, naming the wave Shai-Hulud 2.0 and saying trojanized versions of legitimate npm packages were uploaded between 21 and 23 November 2025.[3]
- Wiz and Unit 42 report that the new variant runs during npm's preinstall phase, using payload files named setup_bun.js and bun_environment.js.[3,4]
- Unit 42 counted over 25,000 malicious GitHub repositories across about 350 unique users, with stolen secrets posted to public repos described as 'Sha1-Hulud: The Second Coming'.[4]
- Wiz listed packages from Zapier, ENS Domains, PostHog and Postman among those affected.[3,5]
- The malware registers infected machines as self-hosted GitHub Actions runners, giving attackers command and control; Wiz says the runner is named SHA1HULUD.[1,3,4]
- Unit 42 says that if the malware cannot steal credentials or secure an exfiltration channel, it attempts to destroy the victim's home directory.[4]
- GitHub said the second wave added destructive functionality and a focus on CI environments, including privilege escalation against some build agents.[1]
- On 9 December 2025, npm permanently revoked all classic tokens and switched npm login to two-hour session tokens.[2]
where sources differWiz's timeline puts the earliest malicious uploads at ~03:00 UTC on 24 November, while its body text and The Register say 21–23 November; Wiz cites ~700 compromised packages in its key takeaways and nearly 800 in the body; Wiz's key takeaways say the repos span ~500 GitHub users, while its summary and Unit 42 say about 350.
sources5
- 01Strengthening supply chain security: Preparing for the next malware campaign ↗ primaryGitHubaccessed 2026-10-21
- 02npm classic tokens revoked, session-based auth and CLI token management now available ↗ primaryGitHub Changelogaccessed 2026-10-21
- 03Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets ↗ secondaryWizaccessed 2026-10-21
- 04"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26) ↗ secondaryPalo Alto Networks Unit 42accessed 2026-10-21
- 05Shai-Hulud worm returns, belches secrets to 25K GitHub repos ↗ secondaryThe Registeraccessed 2026-10-21