Shai-Hulud npm worm detection: operator instructions, IOCs, and research citations

shai-hulud-detection-operator-instructions.md

Shai-Hulud Detection: Operator Instructions & Research

Threat Overview

Shai-Hulud is a self-replicating npm supply-chain worm first detected in September 2025, with evolved variants continuing through 2026. It autonomously compromises developer environments and CI/CD pipelines to harvest cloud credentials and authentication tokens.

Latest Activity (August 2026):

• May 2026: 170+ npm packages, 404+ malicious versions
• @antv ecosystem: 639 compromised versions
• Copycat variants: chalk-tempalte, @bitwarden/cli v2026.4.0
• Affects 25,000+ GitHub repositories

How Shai-Hulud Works

1. Install-time execution: Malicious preinstall hook runs during npm install
2. Payload delivery: ~10MB obfuscated Bun JavaScript runtime
3. Credential harvesting: Steals NPM tokens, GitHub tokens (ghp_, gho_), CI/CD secrets
4. Persistence: Drops files into .claude/ (Claude Code) and VS Code directories
5. Propagation: Republishes compromised packages with same pattern

Indicators of Compromise (IOCs)

File IOCs

If any of these files exist in your home directory, your machine is likely compromised:

• cloud.json – exfiltrated cloud credentials
• contents.json – stolen package contents
• environment.json – environment variables dump
• truffleSecrets.json – Truffle framework secrets
• bun_environment.js – malicious Bun bootstrap script

Environment/Configuration IOCs

• .npmrc with suspicious auth tokens recently accessed
• GitHub Actions workflows named formatter_* in your repos
• Unexpected commits with secret exfiltration artifacts

Package IOCs (Known Compromised)

• @bitwarden/cli ≥ v2026.4.0
• chalk-tempalte (typosquat of chalk)
• @antv/* ecosystem packages (639+ versions)
• Any package version from May 2026 wave with suspicious preinstall hooks

Network IOCs

• RSA-4096 encrypted outbound connections to attacker C2
• SHA256: e71ba441d172460c01fdde2c1a9bc80f432456a70b55f625d21aa6ed77e6f49c

Detection Script Usage

The included shai-hulud-verify.sh performs 6 critical checks:

1. Malicious JSON files – Scans home directory for exfiltration artifacts
2. Bun runtime – Flags if Bun is installed (used to bootstrap malware)
3. GitHub workflows – Searches for secret exfiltration patterns
4. Known packages – Checks package.json for compromised package versions
5. NPM tokens – Verifies .npmrc doesn't show unauthorized access
6. GitHub tokens – Checks environment for exposed GitHub credentials

Running the Script

bash shai-hulud-verify.sh

Output interpretation:

• ✓ NONE FOUND / NOT installed / No tokens – CLEAN
• ⚠ WARNING – Requires investigation (see below)

Interpreting Results

Safe Findings (Green)

• ✓ No malicious JSON files
• ✓ No GitHub workflow exfiltration
• ✓ No compromised packages in package.json
• ✓ No GitHub tokens in environment
• ✓ Bun not installed (or installed before May 2026)

Requires Investigation (Yellow)

• ⚠ Bun installed: Check installation date (ls -la $(which bun))
  • Pre-May 2026: Likely legitimate
  • Post-May 2026: Verify against attack timeline
• ⚠ GitHub workflows flagged: Verify they're in /go/pkg/mod/, node_modules/, or .cache/ (dependencies)
  • Suspicious if in active project repos with secret access
• ⚠ NPM token in .npmrc: Rotate it (npm logout && npm login)

Critical Findings (Red)

• Any malicious JSON files → Machine is compromised
• formatter_* workflows in active repos → Investigate immediately
• Recent suspicious commits with artifact uploads → Breach likely occurred

Confidence Ratings

High Confidence (95%+): NOT AFFECTED

• No malicious JSON files found
• No exfiltration artifacts
• No suspicious workflow patterns in active repos
• Bun predates attack waves OR not installed

Medium Confidence (70-85%): LIKELY NOT AFFECTED

• Bun installed during attack window but no other IOCs
• Suspicious workflows only in dependency caches
• NPM token exists but no unauthorized access

Low Confidence (<70%): REQUIRES ESCALATION

• Multiple IOCs present
• Suspicious recent commits
• Unknown installation patterns

Response Procedures

If NOT Affected

1. Rotate npm token (precautionary): npm logout && npm login
2. Enable GitHub secret scanning: Settings → Security
3. Audit recent npm install commands against Cirosec IOC list
4. Review GitHub Actions logs for unauthorized access

If Possibly Affected

1. ISOLATE: Disconnect from network
2. PRESERVE: Don't delete suspected files; preserve for forensics
3. ESCALATE: Report to security team with findings
4. ROTATE: All tokens/credentials (after isolation)
5. AUDIT: Review git history for backdoors
6. REBUILD: Consider fresh OS install if critical system

If Definitely Affected

1. INCIDENT: Declare security incident
2. CONTAINMENT: Isolate all development machines
3. FORENSICS: Preserve logs and artifacts
4. RESPONSE: Follow incident response plan
5. REMEDIATION: Rotate all compromised credentials org-wide

Research Sources

Primary Research

• Cirosec: A Collection of Shai-Hulud 2.0 IoCs
• Wiz: Shai-Hulud 2.0 Supply Chain Attack
• Sysdig: 25,000+ GitHub Repositories Affected
• Phoenix Security: Full Technical Dissection

Security Advisories

• Microsoft: Mini Shai-Hulud & @antv Compromise
• Unit 42 (Palo Alto): npm Supply Chain Attack Overview
• Tenable: Mini Shai-Hulud FAQ
• Trend Micro: npm Supply Chain & Cloud-Targeted Variants

Detection Tools

• GitHub: shai-hulud-detect – Detection tool with per-wave IOCs
• Wiz: wiz-research-iocs – CSV of impacted packages

CVE Reference

• CVE-2026-45321: Mini Shai-Hulud (@antv compromise variant)

---

Last Updated: August 5, 2026
Script Version: 1.0
Threat Level: ACTIVE (Recent waves detected through August 2026)