Shai-Hulud worm returns to npm, infecting 868 packages with over 2 billion monthly downloads

Kamy Le
Aug 5
4 min read

The npm open-source ecosystem has just experienced a major shock. On August 4, 2026, a malware campaign named Shai-Hulud re-emerged as a worm (a type of malware capable of self-replicating and spreading automatically). The attack directly targeted the software supply chain, hijacking critical developer accounts and rapidly poisoning a wide array of popular programming libraries.

Infection scale and supply chain intrusion methods

Within a short period, this outbreak affected at least 868 library packages across more than 1,381 different versions. It is estimated that total downloads of the impacted packages exceeded 2 billion per month, placing the entire shared software infrastructure on red alert.

It all began when the attacker compromised the GitHub account of the developer responsible for keyv – a highly popular data storage library with approximately 127 million weekly downloads. From this foothold, the attacker quickly pushed malicious code directly to the project's main branch and published new versions.

Because this developer also managed several other critical caching projects, a domino effect occurred immediately. A series of core libraries fell into the crosshairs, including:

keyv version 6.0.0 (approx. 604 million downloads/month).
flat-cache version 6.1.24 (580 million downloads/month).
file-entry-cache version 11.1.6 (571 million downloads/month).
cacheable-request version 13.0.20 (137 million downloads/month).
Numerous other related projects such as cacheable, @cacheable/memory, cache-manager, @cacheable/node-cache, @cacheable/utils, @cacheable/net and ecto.

Moving beyond a single author, the worm automatically propagated through the system's "web of trust." When a developer inadvertently installed an infected package onto their personal machine, the worm stole their credentials to infect subsequent projects. Consequently, numerous source code packages belonging to major organizations and corporations such as Deliveroo (@deliveroo/reevent), Picsart (@picsart/ai-sdk), Qlik (@qlik/embed-runtime) , and Picasso.js were drawn into the infection loop.

Stealth activation mechanism during package installation

A notable aspect of this attack lies in how the malware executes automatically without requiring complex user interaction. Each poisoned library package was injected with two new files, setup.mjs and Math_Symbol.js, along with a covert activation command ("preinstall": "node setup.mjs") added to the package.json configuration file.

Whenever anyone runs the library installation command (npm install), the system automatically executes setup.mjs before the installation completes. The setup.mjs file acts as an obfuscated "dropper" designed to bypass security tools. This file silently downloads the Bun JavaScript runtime environment from the Internet to the system, then uses Bun to run the main malicious payload file, Math_Symbol.js.

Capabilities for harvesting authentication data and sensitive information

The main payload file, Math_Symbol.js , which is about 728 KB in size, functions as a large-scale secret harvester. It scans for and seeks out nearly all critical access keys on the victim's machine:

Development service authentication credentials (npm & GitHub): Searches for npm tokens in the .npmrc configuration file and validates them directly against npm servers. Simultaneously, it extracts GitHub tokens and even directly scans the memory of GitHub Actions runner automation systems.
Cloud & Infrastructure accounts: Collects AWS access credentials from configuration files, environment variables, and metadata services. It also steals access tokens for Kubernetes container management systems, HashiCorp Vault keys, and sweeps up all stored information within them.
Payment gateways & Collaboration tools: Scans for API keys belonging to the Stripe payment service and the Slack workplace platform.
Full disk scanning: The malware utilizes approximately 200 search patterns to locate .env environment files, SSH private keys (*.pem, *.key), VPN configuration files, KeePass password databases, configuration data for Terraform and Docker, as well as developer tools like VS Code and Claude Code.

Encryption, exfiltration methods, and self-replication capabilities

To ensure collected data is neither intercepted nor exposed, the worm encrypts all gathered information using the RSA public-key algorithm prior to exfiltration. This means only the attacker possessing the corresponding private security key can decrypt and view the contents.

The primary exfiltration channel consists of public GitHub repositories titled or described with the string "Shai-Hulud: Here We Go Again". If uploading data to GitHub fails, the malware falls back to a backup channel (npm-cache[.]com). The network address of this fallback channel is dynamically retrieved via a smart contract on the Ethereum blockchain network, allowing the attacker to easily modify infrastructure without editing the malware files.

Even more dangerously, the worm includes highly aggressive self-replication capabilities via two vectors:

Infection via npm packages: Uses compromised npm tokens to search for all projects where the victim has administrative privileges. It automatically increments version numbers, injects malicious code (setup.mjs and math_init.js) , and publishes the new version to the official registry.
Infection via GitHub source repositories: Uses GitHub tokens to automatically create commits across project branches. The malware inserts covert scripts into VS Code and Claude Code application configurations. As a result, if another developer simply opens the project using these tools, the malware launches immediately without requiring an npm installation command to be executed.

The resurgence of the Shai-Hulud worm underscores the growing sophistication of open-source supply chain attacks. By leveraging cloud infrastructure, automation services, and popular developer tools to turn developer workstations into malware distribution hubs, attackers pose a major challenge to information security verification efforts across enterprises and the broader tech community.

Reference: Cyber Press