Shai-Hulud: the self-spreading worm campaign on npm and PyPI

How they got in:How the attackers first got publish rights is unresolved; reports only confirm stolen maintainer accounts or tokens. Wiz links it to the August 2025 Nx attack, as an assessment.

What it did:A postinstall step ran bundle.js: it read environment variables, scanned the filesystem with TruffleHog, queried cloud metadata and secret stores, uploaded the results to a public repo named Shai-Hulud in the victim's account, and planted shai-hulud-workflow.yml to keep leaking secrets.

Scale (reports differ): 40+ packages at first(Socket [31]);16 Sept update: nearly 500 packages, including CrowdStrike packages(Socket [31]);500+ packages(StepSecurity [51]);195 packages listed with versions(StepSecurity [51]);187+ packages at the time of publication, expected to grow(Semgrep [22]);Over 100 packages, according to the article text(Wiz [58]);Appendix lists about 200+ package names and 200+ versions(Wiz [58]);The first 40 (citing Socket/StepSecurity), then "147+ additional"; whether that means 187 in total is unconfirmed(Aikido Security [38]);Removed 500+ compromised packages from npm(GitHub [3]);Over 500 packages(CERT/CC [47])

Attribution: Assesses that the campaign is "directly downstream" of the late-August 2025 s1ngularity/Nx compromise (an assessment; no confidence level given)(Wiz [58]);The article title links this wave to the s1ngularity/Nx attackers and says they reused much of the Nx playbook; Aikido reads the name "Shai-Hulud" as the attacker's own branding and does not attribute it to any named group(Aikido Security [38]);Says with "moderate confidence" that the attacker used a large language model (LLM) to help write the code, based on comments and emojis in the bash script; this does not name any actor(Palo Alto Networks Unit 42 [35])

How they got in:In PostHog's case, the attackers abused a pull_request_target workflow misconfiguration to steal a bot account's GitHub token, then rewrote the workflow to get publish rights.

What it did:setup_bun.js downloads Bun and runs the obfuscated bun_environment.js in the background: it collects environment variables, .npmrc, cloud credentials and GitHub tokens, puts them encoded into a new public repo, then infects the victim's other packages; without usable tokens it may wipe the home directory.

Scale (reports differ): 796 unique npm packages(Datadog Security Labs [21]);1,092 package versions(Datadog Security Labs [21]);About 700 npm packages (its appendix says "800+")(Wiz [57]);492 packages(Aikido Security [40]);795 npm packages(ReversingLabs [50]);"Over 70" packages at the time of writing(StepSecurity [53]);500+ packages(Socket [30]);700+ versions(Socket [30]);830+ npm packages(The Hacker News [32]);1 Maven artifact (org.mvnpm:posthog-node:4.18.1), the only Java package affected at the time of reporting(The Hacker News [32]);8 PostHog JavaScript packages compromised(PostHog [12]);"Golden Path" strain: 1 package (@vietmoney/react-big-calendar), with no major spread seen(Aikido Security [39])

Attribution: No attribution has been confirmed.(Wiz [57]);Aikido judges the December "Golden Path" strain "highly unlikely to be a copy-cat" because its code was re-obfuscated rather than edited, which points to the original actor. This is the researchers' assessment, not a confirmed attribution.(Aikido Security [39])

How they got in:SAP: a developer's GitHub account was taken over and a publish workflow on a non-default branch was modified to obtain an npm token. Lightning: possibly a leaked project-scoped PyPI token, unconfirmed.

What it did:Runs on install or import, steals developer and CI credentials, and plants files and workflows in writable GitHub repos to keep spreading.

Scale (reports differ): SAP incident: 4 malicious versions (@cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1, mbt@1.2.48)(BleepingComputer [41]);The @cap-js packages have about 1M monthly downloads combined; mbt about 200K(SafeDep [16]);Over 1,000 GitHub repositories poisoned in the SAP wave(SafeDep [16]);2 malicious versions of the PyPI package lightning (2.6.2, 2.6.3)(Socket [25])

Attribution: Aikido and Socket linked the SAP incident to TeamPCP with medium confidence, based on code and tactics seen in the Trivy, Checkmarx and Bitwarden attacks.(BleepingComputer (reporting Aikido and Socket) [41]);The attacker posted a PGP-signed message branded "Team PCP" on a Tor site claiming LAPSUS$ was heavily involved. Socket has not verified the signature or the claims, and judges this to be a different actor from the original Shai-Hulud using a similar playbook.(Socket [25]);Attributes the Lightning incident to TeamPCP and repeats the LAPSUS$ claim, with no stated confidence level.(The Hacker News [33])

Scale (reports differ): 42 packages, 84 malicious versions(TanStack [4])

Attribution: The "Mini Shai-Hulud" name and the attribution to TeamPCP(StepSecurity [52]);Same campaign, with other packages hit the same day(Wiz [56])

Scale (reports differ): @antv wave: 637 versions across 317 packages (the URL says 314)(SafeDep [17]);@antv wave: 639 versions across 323 packages(Socket [24]);Whole campaign: 1,055 versions across 502 packages (npm 1,048 / 498; PyPI 6 / 3; Composer 1)(Socket [24]);About 1.9k GitHub repositories used to hold stolen data(Socket [24]);@antv wave: 645 versions across 324 packages (318 of the 547 packages under one maintainer account, plus 6 under another); about 16M combined weekly downloads(OpenSourceMalware [6]);Copycats: 4 packages with 2,678 weekly downloads in total(OX Security [49])

Attribution: Attributes the @antv wave to TeamPCP, without a confidence level or evidence in the text.(OpenSourceMalware [6]);Ties the @antv wave to the "Mini Shai-Hulud" campaign because the operating model is the same, without naming an actor.(Socket [24]);Says with high confidence that the four copycat packages come from a different actor, not TeamPCP, because they are barely obfuscated and their timing matches the source-code leak and a "supply chain attack competition" on BreachForums.(OX Security [49])

How they got in:The attackers controlled the npm account that publishes these packages; how it was first compromised has not been disclosed.

What it did:A preinstall step runs ./tools/setup (a Linux binary) that collects dozens of cloud, AI-service and CI credentials, then pushes back-dated malicious commits to every writable GitHub repo.

Scale (reports differ): 33 malicious-package records (from our OSV snapshot)(OSV [10]);37 package@version entries in its IoC table (the text gives no total)(JFrog Security Research [13]);57 back-dated malicious commits across 9 GitHub organisations(JFrog Security Research [13]);About 4,500 contributions to private projects by the compromised account during the active period(JFrog Security Research [13]);37 packages, 9 organisations, 57 back-dated commits and about 4,500 private contributions; warns the public count is a lower bound(Phoenix Security [11]);43 malicious packages, 37 of them listed by name(SafeDep [19]);"Over 50" npm packages(The Hacker News [34])

Attribution: The operator is unknown. They made operational-security mistakes: putting their own wallet recovery phrase in the malware's skip-list, leaving the eBPF build path in the program, and not stripping debug metadata. The Ethereum address derived from the phrase is nearly empty.(JFrog Security Research [13]);An "unknown actor", operationally adjacent to Shai-Hulud / TeamPCP, with "no confirmed identity overlap".(Phoenix Security [11])

How they got in:npm: the attackers created malicious branches in Red Hat repos and rewrote CI workflows; trusted publishing checked the repo and workflow file name but not the branch. PyPI: taken-over maintainer accounts or leaked API tokens.

What it did:After install (npm) or at Python startup (PyPI) it downloads Bun and runs a stealer that collects developer and cloud credentials, spreads to other packages and repos, and stores the data in public GitHub repos; reports disagree on whether it deletes files.

Scale (reports differ): npm: 32 @redhat-cloud-services packages, 96 malicious versions(SafeDep [18]);These packages come from 3 GitHub repositories: javascript-clients (15), frontend-components (14), platform-frontend-ai-toolkit (3)(SafeDep [18]);PyPI: 37 malicious wheel files across 19 projects(Socket [29]);Campaign-wide: 448 artifacts (411 npm across 106 packages, 37 PyPI across 19). The npm figure covers the whole campaign and is not a Red Hat count(Socket [29]);Campaign-wide: 471 artifacts (411 npm across 106 packages, 60 PyPI across 37 packages), including 23 newer PyPI package versions(Socket [27]);PyPI: 30 distinct packages, 36 compromised versions(StepSecurity [54]);PyPI: 6 bioinformatics packages, 1 malicious version each(Endor Labs [46]);PyPI: 5 confirmed packages(O3 Security [5]);pantheon-agents: affected versions 0.6.1 and 0.6.2 (OSV)(OSV [8]);pantheon-agents: GitLab's database lists the affected range as 0.6.1 through 0.6.3, but its own description names only 0.6.1 and 0.6.2(GitLab Advisory Database [2])

Attribution: Attributes the wave to TeamPCP and links the group to Shai-Hulud 2.0 and the LiteLLM compromise, without showing evidence in the post(O3 Security [5]);Mentions "operational security hardening by TeamPCP" in a single sentence, with no reasoning given(Endor Labs [46]);Calls it an evolution of the Miasma threat actor, based on overlapping techniques(StepSecurity [54]);Says attribution is unclear: TeamPCP released Shai-Hulud as open-source attack tooling and promoted a BreachForums contest, so many different actors could run similar operations(Socket [26]);Links the waves to Shai-Hulud / Miasma on technique but does not name an actor(Socket [29])

How they got in:Several reports say the maintainer's GitHub account was taken over and malicious code was pushed to main, then released by the normal trusted-publishing pipeline; how the account was taken is unconfirmed.

What it did:A preinstall setup.mjs downloads Bun and a second stage that steals cloud, GitHub, npm and AI-tool credentials, infects other packages the victim can publish, and installs gh-token-monitor for persistence.

Scale (reports differ): 444 package names(SafeDep [15]);2,234 poisoned versions(SafeDep [15]);Credentials of 12 organisations abused(SafeDep [15]);@servicetitan: 147 packages, 1,082 versions(SafeDep [15]);@onereach / @or-sdk: 155 packages, 487 versions(SafeDep [15]);@ornikar: 47 packages, 537 versions(SafeDep [15]);@qlik / @nebula.js: 59 packages(SafeDep [15]);At least 444 packages (5 August update)(Aikido Security [36]);1,381 versions (5 August update)(Aikido Security [36]);About 1,300 drop repositories(Aikido Security [36]);444 packages(OX Security [48]);821 repositories found through the marker string(OX Security [48]);More than 400 packages(JFrog Security Research [14]);More than 1,700 versions(JFrog Security Research [14]);384 packages (4 August, 11:00 PDT update)(Endor Labs [45]);1,136 versions (4 August, 11:00 PDT update)(Endor Labs [45]);About 515 million weekly downloads for the three seed packages(Endor Labs [45]);More than 400 packages, with more than 1.3 billion monthly downloads(Elastic Security Labs [44]);More than 1,300 versions, with about 2 billion combined monthly downloads(Cyber Security Agency of Singapore [43]);10 core packages; 400 to more than 2,200 downstream (the source does not make clear whether these are packages or versions); "5 confirmed malicious versions" (the source's wording is unclear)(Chainguard [42]);At least 10 confirmed packages, list still growing; tens of millions of weekly downloads(Socket [28]);July downloads: keyv 619.7M, flat-cache 579.8M, file-entry-cache 571.2M(Snyk [23]);446 records in PlainCVE's OSV snapshot (published 2026-08-04 to 08-06)(OSV / OpenSSF malicious-packages [9])

Attribution: The methods "closely match" Shai-Hulud, but Socket makes no firm attribution to a campaign.(Socket [28]);This is a descendant of "Mini" Shai-Hulud, heavily based on public Mini Shai-Hulud repositories published by TeamPCP. This only shows where the code came from; it does not show that TeamPCP carried out this attack.(Wiz [55]);The marker string and the GitHub drop-repository method match the May 2026 TanStack compromise, but SafeDep calls the link "circumstantial".(SafeDep [15]);Describes ChainDrop as a variant of the Shai-Hulud family.(Cyber Security Agency of Singapore [43]);No one has claimed the attack and no attacker is named. Chainguard mentions TeamPCP only for the May @antv wave, not for this one.(Chainguard [42])