Shai-HuludMalware
A Javascript-based worm propagating through GitHub repositories and exfiltrating tokens and other credentials.From MISP Galaxy
Last reported 8 days ago, by Cyble31 reports
ATT&CK techniques
6 of 66 · each with the sentence it comes from- T1195Supply Chain Compromise
“According to the 2026 Unit 42 Global Incident Response Report, software supply chain compromises have become a leading initial access vector targeting enterprise cloud environments.”
- T1213.003Code Repositories
“Around 28% of secrets incidents originated entirely outside source-code repositories in collaboration and productivity systems.”
- T1552.004Private Keys
“T1552.004 Unsecured Credentials: Private Keys SSH private key exfiltration”
- T1684Social Engineering
“…cyber crime groups continue to use AI capabilities as force multipliers across the attack lifecycle—from target reconnaissance and social engineering lure creation to custom malware obfuscation and post-exploitation troubleshooting.”
- T1036Masquerading
“Systemd masquerading for persistence”
- T1059Command and Scripting Interpreter
“T1059.004 Command and Scripting Interpreter: Unix Shell Shell scripts and Bun-based payloads executing in CI runners”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
31 reports · the newest 20, newest first · the exact sentence from each-
Your AI Agent Doesn’t Have MFA“… AI Risk and Resilience Report 2026, describes a hijacked AI coding assistant session that installed a poisoned package and spread the Shai-Hulud worm across about 100 repositories, plus poisoned assistant command-line hooks that handed attackers code execution.”
-
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years“…e’s AI agent sandboxes, was compromised to run a credential-stealing worm during installation, in what Socket describes as a ChainDrop/Shai-Hulud supply chain attack.”
-
Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise“Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise”
-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm“Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm”
-
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack“TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack”
-
Evolution of Web3 in Cloud Supply Chain Attacks“Traced to the Shai-Hulud family, ChainDrop infected over 400 npm packages (including keyv and cacheable-request).”
-
The Credential Layer Is Expanding Faster Than Security Teams Can See It“The end of 2025 brought new waves of infostealer attacks like Shai-Hulud and S1ingularity, which turned the developer laptop into a target and an entry point into the supply chain.”
-
The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches“Shai-Hulud: Install-Time Theft at Ecosystem Scale”
-
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data“Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data”
-
Happy Birthday, Shai-Hulud“Happy Birthday, Shai-Hulud”
-
Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal“Shai-Hulud is back after 111 days: The Shai-Hulud worm has been spotted on npm again after a hiatus of 111 days (May 19, 2026).”
-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“Upon successful exploitation and gaining initial access via Phalanx or manual Burp Suite efforts, the actor drops the Shai-Hulud framework onto the compromised hosts.”
-
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages“Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages”
-
ChainDrop Worm Hits 400+ npm Packages with Two Billion Monthly Installs“Read more on Shai-Hulud: Shai-Hulud-Like Worm Targets Developers via npm and AI Tools”
-
'ChainDrop' worm compromises hundreds of popular npm packages“The injected payload can spread on its own, similar to the Shai-Hulud npm worm.”
-
Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more“Any false negative you may notice, especially on packages that are part of impactful campaigns (e.g., Shai-Hulud)”
-
Shai-Hulud Goes Open Source“Shai-Hulud Goes Open Source”
-
CI/CD pipeline abuse: the problem no one is watching“The Shai-Hulud npm worm went further.”
-
Six Supply Chain Attack Groups to Watch Out for in 2026“Shai-Hulud”
-
Shai-Hulud V2 Poses Risk To NPM Supply Chain“Shai-Hulud V2 Poses Risk To NPM Supply Chain”
Indicators in its reports
named in the reports above- npm-cache[.]comin 2 reports
- awqhnjewqjkl[.]icuin 2 reports
- 9fc2570b7cef51c1…fc2509cf1bccin 2 reports
- fd3ca4007b225fdf…806e5684b1ebin 2 reports
- blog.gitguardian[.]comin 2 reports
- 3f3f42d072bd3686…ec0ea572eea7in 2 reports
- 29ac906c8bd801df…278c24e4f1a7in 2 reports
- 619c56acf572df75…2da3a44f10b4in 2 reports
- hxxps://npm-cache[.]com/routerin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.