Loading story…
A wave of software supply-chain attacks spanning late 2025 through September 2026 compromised package-publishing and CI/CD credentials to push malicious updates into trusted ecosystems. Campaigns tracked as S1ngularity, Shai-Hulud, and TeamPCP stole secrets, infected downstream users, and in some cases republished themselves through additional packages. S1ngularity compromised Nx packages and abused victim-hosted AI agents and GitHub repositories to find and exfiltrate credentials, while Shai-Hulud expanded the approach with worm-like propagation using stolen npm credentials.
TeamPCP was linked to similar compromises affecting Trivy, Checkmarx, LiteLLM, Telnyx, TanStack, and more than 60 npm packages; reporting attributes suspected losses of hundreds of millions of dollars to the group and notes the arrest of two people in Australia in connection with it. Microsoft published detection, investigation, and defensive guidance for Shai-Hulud 2.0, underscoring the need for organizations to investigate exposed publishing credentials, review package releases and CI/CD activity, rotate compromised secrets, and assess downstream environments for malicious dependency updates.
Trace attribution and downstream blast radius.
10 events from the most recent confirmed update back to the earliest known activity.
TeamPCP allegedly used the compromised Trivy service account to modify existing version tags and publish a malicious update through Trivy's automated systems. The implanted malware identified itself as "TeamPCP Cloud stealer."
TeamPCP allegedly extracted a privileged access token from Trivy. Trivy detected the exposure, but incomplete credential rotation allegedly left a compromised service account usable.
TeamPCP published an open-source Shai-Hulud variant called Mini Shai-Hulud and offered a US$1,000 reward for the largest supply-chain attack using it.
Shai-Hulud, also called Shai-Hulud 2.0 or SHA1-Hulud, returned in two attacks. One used a Pwn Request and malicious OpenVSX extension to exfiltrate a CI token; the other targeted projects including Zapier, PostHog, and Postman using long-lived credentials exposed in compromised repositories and executed its payload with Bun.
The initial Shai-Hulud campaign began targeting open-source tools, collecting secrets, and exfiltrating data through GitHub accounts. It propagated worm-like by stealing npm publishing credentials and using them to publish malicious updates to further packages.
S1ngularity compromised several Nx packages after using a crafted pull request and chained weaknesses to obtain a repository token. It replaced a legitimate CI script, triggered package publishing with an exfiltrated npm token, and distributed infected updates.
The retrospective attributes compromises of Checkmarx, LiteLLM, and Telnyx to TeamPCP-related activity. LiteLLM and Telnyx were allegedly compromised through malicious packages uploaded to PyPI.
During the Trivy compromise, TeamPCP allegedly harvested npm tokens and used them to distribute CanisterWorm to more than 60 npm packages. CanisterWorm stole victim npm tokens and overwrote associated packages with malicious versions to continue propagating.
The ChainDrop campaign used Mini Shai-Hulud with an obfuscated Bun JavaScript payload and reportedly produced more than 400 patches while active. It attempted HTTPS exfiltration before creating a public GitHub repository named "Shai-Hulud: Here We Go Again" when that failed.
Microsoft Defender Security Research Team released guidance for detecting, investigating, and defending against the Shai-Hulud 2.0 supply-chain attack.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
reversinglabs.com
Open sourcemicrosoft.com
Open sourcenx.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale supply chain attack has targeted the Node Package Manager (NPM) ecosystem, compromising hundreds of widely used JavaScript packages and threatening the security of software development pipelines globally. In mid-September, cybersecurity researchers identified a self-propagating malware dubbed "Shai-Hulud," which was distributed through trojanized NPM packages, including some with millions of weekly downloads and high-profile packages such as those from CrowdStrike. The attack leveraged a malicious "bundle.js" script that downloaded and executed TruffleHog, a legitimate credential scanner, to harvest developer and CI/CD tokens, cloud service credentials, and environment variables from compromised systems. The stolen credentials were exfiltrated via hard-coded webhooks and GitHub Actions workflows, enabling the attacker to further propagate the malware and gain unauthorized access to sensitive resources. The campaign affected both Windows and Linux systems, increasing its reach and impact across diverse development environments. Sysdig reported that the attack on September 15 involved approximately 200 compromised packages, including @ctrl/tinycolor, and was linked to an attacker who had previously targeted Nx packages in late August. The worm not only stole secrets but also published them publicly on GitHub and attempted to make victim repositories public, amplifying the risk of further compromise. Earlier in the month, other popular packages such as chalk, debug, and duck were also compromised following a successful spear phishing attack against a maintainer, with the attacker seeking to redirect cryptocurrency payments. NPM responded by removing the malicious package versions, but users were required to update or revert to secure versions to mitigate the risk. Sysdig provided same-day threat intelligence and detection capabilities to its customers, including open source Falco rules to identify and respond to the threat. The attack demonstrated the vulnerability of even the most trusted and widely used open source packages, highlighting the importance of continuous monitoring and rapid response in the software supply chain. Security researchers and vendors emphasized the need for organizations to scan their environments for known malicious packages, such as dist.fezbox.cjs, and to review logs for signs of credential exfiltration. The incident underscored the evolving tactics of threat actors targeting developer ecosystems, using advanced techniques to automate propagation and maximize impact. Organizations relying on NPM packages and CI/CD pipelines were urged to remain vigilant, update dependencies promptly, and leverage threat intelligence resources to defend against similar attacks. The Shai-Hulud campaign remains an evolving threat, with ongoing analysis and mitigation efforts by the security community. This incident serves as a stark reminder that popularity and trust in open source packages do not guarantee safety, and proactive security measures are essential to protect software supply chains from compromise.
Jun 29, 2026
A supply-chain malware campaign known as **Shai-Hulud** compromised hundreds of packages in the npm ecosystem and later spread into both npm and PyPI, using stolen maintainer credentials and trusted publishing workflows to push trojanized releases. Early reporting said the worm affected more than 500 npm packages, searched infected developer and CI/CD environments for GitHub Personal Access Tokens, cloud API keys, and other secrets, and exfiltrated them to attacker-controlled infrastructure and public GitHub repositories. GitHub removed hundreds of malicious packages, while CISA urged organizations to review dependencies, check for cached malicious packages, rotate credentials, and enforce phishing-resistant MFA for developer accounts. Later waves became more aggressive and broader in scope. Researchers said a second campaign hit hundreds more npm packages and had a blast radius exceeding **27,000 repositories**, abusing `preinstall` and other lifecycle hooks to steal secrets, hijack GitHub Actions, self-propagate into additional packages, and in some cases deploy a conditional wiper-like payload. A subsequent **Mini Shai-Hulud** wave affected more than 170 packages across npm and PyPI, including packages tied to TanStack, Mistral AI, OpenSearch, Guardrails AI, UiPath, and others; it used files such as `router_init.js`, invoked Bun through malicious package scripts, targeted npm, GitHub, cloud, Kubernetes, Vault, and CI/CD credentials, and demonstrated that provenance and OIDC-based trusted publishing can still be abused when attacker-controlled code runs inside legitimate release workflows.
Jun 30, 2026
A major supply chain attack targeted the npm ecosystem in September 2025, where an infostealer with worm-like characteristics, dubbed **Shai-Hulud**, compromised over 500 npm packages. The attack leveraged a previous compromise of the `s1ngularity/nx` project, exploiting CI/CD pipeline credentials and propagating through both direct and indirect dependencies. Security researchers confirmed that attackers exfiltrated GitHub and npm tokens, enabling them to inject malicious code into widely used packages and potentially access internal networks, move laterally, or tamper with software releases. The incident highlighted the persistent risks associated with CI/CD pipeline security, as attackers exploited overlooked access to secrets such as API keys and deployment tokens. The scale of the attack forced engineering and security teams worldwide to spend significant resources cleaning compromised environments and assessing exposure, even though the direct financial impact was limited. The event underscored the need for enhanced runtime security monitoring, such as eBPF-based sensors, and stricter controls on package publishing and consumption to defend against similar threats in the future.
Jun 29, 2026