Shai-Hulud Hits npm: 440+ Packages Compromised with Valid…

The Shai-Hulud campaign has infected over 440 npm packages with 2+ billion monthly downloads. The worm exploits signed GitHub Actions provenance to hide malicious code inside legitimate trust mechanisms.

On the morning of August 4, 2026, a supply-chain attack compromised the GitHub account of jaredwray, maintainer of keyv and flat-cache, packages with a combined 565 million monthly downloads. Within hours, the Shai-Hulud campaign had infected over 440 npm packages — a figure that later grew to 1,280+ according to Aikido Security updates via DevOps.com — generating over 2 billion monthly downloads potentially exposed. The mechanism is not an npm flaw nor a cryptographic bypass: it is the exact use of the trust mechanisms that supply-chain security promotes as the solution.

Key Takeaways

The malware spreads via math_init.js and Math_Symbol.js files with preinstall scripts, downloading the Bun runtime from GitHub releases to evade Node.js-based detection
Malicious versions carry valid GitHub Actions-signed provenance: the digital signature attests to where the package was built, not that the source code is legitimate
Theft of npm, GitHub, AWS, Kubernetes, Vault, Slack, Stripe, SSH, and VPN tokens fuels autonomous worm-like propagation to 50-100 new packages every few minutes
Persistence extends to IDEs and local AI agents via modifications to .claude/settings.json and .vscode/tasks.json, with a dead man's switch threatening data deletion if stolen tokens are revoked

How a Legitimate Maintainer Becomes an Unwitting Infection Vector

The entry point was the compromise of jaredwray's GitHub account. Ilyas Makari, malware researcher at Aikido Security, described the sequence: "the bad actor on the morning of August 4, compromised the GitHub account of jaredwray." The attacker pushed malicious files directly to the main branch and immediately cut a new release. The result: poisoned versions published to npm with provenance signed by GitHub Actions, exactly as occurs for every legitimate release.

Kiran Raj, researcher at Endor Labs, corroborated the pattern: "an npm publishing token was stolen and used to push malicious versions, in most cases a CI or service-account token likely harvested from a build runner that had itself installed a poisoned dependency." The initial compromise generated stolen tokens, which in turn enabled new publications, creating a positive feedback loop for the attacker.

The Payload: Bun, RSA, and 200 Scan Patterns

The initial dropper, math_init.js, activates the main payload Math_Symbol.js — 728 KB of heavily obfuscated code. This does not execute via Node.js: setup.mjs downloads and runs the Bun runtime from github.com/oven-sh/bun/releases/download/bun-v1.3.13/, evading standard security controls built around the Node ecosystem. The malware then implements a filesystem scanner with 200 glob patterns, 64 maximum concurrent reads, and a 5 MB file threshold, hunting for credentials in local and CI environments.

Stolen data is encrypted with an RSA public key embedded in the payload. Primary exfiltration targets public GitHub repositories tagged "Shai-Hulud: Here We Go Again" — 821 at the time of detection by OX Security, approximately 1,300 per Aikido's update. A sophisticated technical fallback exists: a domain registered on May 22, 2026, whose address is retrieved from the Ethereum smart contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103.

Persistence Beyond Installation: IDEs and AI Agents

The malware does not limit itself to single execution. According to Aikido's analysis, it "adds malicious hooks to .claude/settings.json and .vscode/tasks.json so that the payload executes automatically." This persistence choice extends the attack surface beyond the build environment: developers who open local projects in IDEs with modified user configurations reactivate the payload without any new installation. Local AI agents, configured to automatically read project settings, become vectors for continuous execution.

Beyond persistence, the malware includes a dead man's switch. According to OX Security, it activates "a dead man's switch trigger, to delete the current machine if the stolen GitHub token is revoked." The embedded extortion string is explicit: "IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients." The dossier contains no evidence of this threat's actual implementation, nor of the number of machines where it may have materialized.

"the bad actor on the morning of August 4, compromised the GitHub account of jaredwray [...] the poisoned versions were published to npm with valid provenance signed by GitHub Actions"
— Ilyas Makari, malware researcher, Aikido Security (via DevOps.com)

The Structural Problem: Provenance vs. Authorization

The Shai-Hulud campaign does not violate provenance mechanisms: it exploits them for exactly what they were designed to do. A valid GitHub Actions signature attests that a package was built by a specific workflow on a specific repository. It does not attest that the repository maintainer authorized that code, nor that the source code contains no malicious payload.

Peyton Kennedy, researcher at Endor Labs, had already articulated this distinction in prior analyses: "provenance tells you where a package was built, not whether the build was authorized." The August 4, 2026 campaign is the operational proof of this fallacy. Supply-chain audit tools — SBOMs, attestations, signatures — provide traceability, not content security. When the build process is compromised at the source, traceability becomes a masking mechanism rather than a revelation mechanism.

Propagation to 50-100 packages every few minutes, as reported by Charlie Eriksen of Aikido, is enabled precisely by the combination of stolen tokens and automatic provenance. Every new malicious version automatically inherits the valid signature of the compromised workflow, without needing to compromise the infrastructure again.

Immediate Actions

Immediately revoke npm, GitHub, and cloud tokens exposed on systems that ran npm install after 09:30 UTC on August 4, 2026, checking access logs for unauthorized use
Inspect .claude/settings.json and .vscode/tasks.json directories on all development machines for unauthorized hooks, and remove suspicious configurations before reopening projects
Block execution of preinstall and postinstall scripts in non-essential CI/CD pipelines, and verify that build runners do not have access to tokens with publishing privileges
Validate npm dependencies against compromised package lists published by OX Security, Aikido, and Endor Labs, comparing SHA-256 hashes of installed versions

Why This Campaign Redefines the Supply-Chain Security Perimeter

The distinction between provenance and authorization is not new, but Shai-Hulud makes it no longer theoretical. The shift from single compromise to autonomous worm-like propagation, mediated by stolen tokens and masked by valid signatures, redefines the threat model for open-source ecosystems. It is no longer sufficient to verify that a package is "signed": one must verify that whoever authorized the repository's content has maintained control of their account.

Jonathan Stross, SAP security analyst at Pathlock, anticipated this evolution: "Shai-Hulud should be understood less as a one-off package compromise and more as an evolving supply-chain playbook." The dossier does not specify the threat actor's identity nor attribute the campaign to known entities with certainty. The RSA public key in the payload, according to OX Security, is "yet to be attributed." The entity controlling the Ethereum smart contract fallback is unidentified.

Information has been verified against cited sources and updated as of publication.

Sources

Sources and references