Shai-Hulud npm Supply Chain Worm

Executive Summary

Shai-Hulud is the first known self-replicating worm in the npm ecosystem. It spreads via malicious preinstall/postinstall scripts, steals credentials, and automatically infects every package the victim can publish.

The good news: This attack is preventable. Disabling lifecycle scripts blocks the entire attack chain.

Attack Status: ACTIVE — Wave 2 ongoing. 800+ packages compromised, 25,000+ repositories exposed, 132M+ monthly downloads affected.

Critical Timeline Update

• November 5, 2025: npm disabled creation of new classic tokens
• November 19, 2025: npm revoked all classic tokens permanently
• If your CI/CD still uses classic tokens, it is already broken.

Understanding the Attack Surface

Where the Attack Executes

The malware runs wherever npm install executes. It is opportunistic — it harvests whatever credentials are available in that environment:

The malware explicitly probes AWS IMDS, GCP metadata endpoints, and Azure IMDS — demonstrating it expects to run in cloud/CI environments, not just developer machines.

Why Both CI/CD and Developer Machines Matter

CI/CD pipelines:

• Often have tokens with broad publish access
• May have access to production secrets
• Run npm install on every build
• IMDS provides cloud credentials without explicit configuration

Developer workstations:

• Often have long-lived tokens (never rotated)
• May have publish tokens stored in ~/.npmrc
• Less likely to have egress filtering
• Less endpoint monitoring
• Developers may install arbitrary packages

Neither environment should be considered “safe” or “primary target.” The attack is opportunistic and effective in both.

The Propagation Problem

What makes Shai-Hulud uniquely dangerous is its self-replicating behavior:

Environment A (any)                    Environment B (any)
─────────────────────                  ─────────────────────
npm install executes                          │
        │                                     │
        ▼                                     │
Malware harvests npm token                    │
        │                                     │
        ▼                                     │
Publishes malware to all                      │
packages token can access          ───────────┘
        │                                     │
        │                                     ▼
        │                          npm install executes
        │                                     │
        │                                     ▼
        │                          Malware harvests NEW token
        │                                     │
        │                                     ▼
        │                          Publishes to MORE packages
        ▼                                     ▼
   EXPONENTIAL SPREAD ACROSS NPM ECOSYSTEM

The infection source is irrelevant. Whether it starts on a developer laptop or CI server, the worm spreads to all packages accessible by stolen tokens.

Developer Workstation Risk

Observed Impact

• One compromised user had access to 528 private repositories — all were made public
• Workflow logs exposed GitHub tokens, npm credentials, Atlassian keys, Datadog API keys
• 25,000+ repositories exposed within hours of Wave 2 starting

Immediate Mitigation Recommendations

Tier 1 — Immediate: Disable Lifecycle Scripts

This single action blocks the entire Shai-Hulud attack chain:

# .npmrc (all projects, all environments)
ignore-scripts=true

# Environment variable (prevents override)
export npm_config_ignore_scripts=true

CI/CD install commands with scripts disabled:

Tier 2 — Short-Term: Token Rotation and Hardening

1. Replace all classic npm tokens with granular tokens (max 90-day expiration).
2. Enable Trusted Publishing (OIDC) where possible — eliminates stored secrets entirely.
3. Enable npm provenance: npm publish --provenance
4. Rotate all credentials:

Tier 3 — Medium-Term: Detection and Monitoring

1. Deploy install-time scanning (Socket, SafeDep vet/pmg, Snyk, Semgrep Supply Chain)
2. Schedule daily SCA scans
3. Enable egress filtering (allowlist preferred)
4. Enable MFA on npm and GitHub (WebAuthn/passkey preferred)
5. Add IMDS access monitoring — unexpected IMDS calls from CI jobs are a strong compromise indicator

Tier 4 — Strategic

• Pin dependencies to exact versions with lockfile-only installs in CI/CD
• Audit npm package publish history for unexpected version bumps
• Review GitHub audit logs for bulk token operations
• Implement AI-assisted dependency review for new packages entering your supply chain

Indicators of Compromise

GitHub Repository Indicators

Key Dates

References

• SafeDep: Shai-Hulud Migration Response
• Wiz Research IOCs
• CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem (2025)
• Socket Security Blog
• npm Official Blog
• GitHub Changelog