Shai-Hulud: Whoever controls your package registry controls your pipeline
The New Stack Zeen Rachidi
npm packages started updating themselves after a worm hit the registry. It spread through trusted publish pipelines and even valid signatures.
Based on reporting by The New Stack, Zeen Rachidi — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
On September 15, 2025, npm saw something that should not happen: packages began changing themselves. No maintainer hit publish. No pull request merged. Yet new versions appeared anyway, each one carrying code that kept the cycle going on other machines with no human in the loop.
The first wave ran from September 14 to 18 and touched more than 500 package versions. The attackers also left a signature of their own — every stolen credential was uploaded to a public GitHub repository named Shai-Hulud, a nod to Frank Herbert’s Dune. Two months later, Shai-Hulud 2.0 came back stronger. On November 24, it backdoored 796 packages, moved earlier in the install flow so developer-side triggers no longer mattered, and, if it found nothing worth stealing or spreading, deleted the user’s home directory on the way out.
By spring 2026, Mini Shai-Hulud had narrowed its appetite. Instead of hoovering up generic developer secrets, it went after credentials for Claude, Codex, Cursor, and Gemini. The pattern is obvious enough: AI coding tools sit inside the projects everyone cares about now, so they’ve become part of the loot pile.
Then ChainDrop showed up a few weeks ago, on August 4, 2026. In less than four hours it compromised more than 400 packages by riding a legitimate, cryptographically signed release pipeline. That gave each poisoned version a valid SLSA provenance attestation, which is exactly the sort of thing defenders like to trust. Its control traffic was hidden in an Ethereum smart contract, so normal domain blocklists were useless.
The trick is ugly in its simplicity. A compromised package runs a postinstall script, looks for npm and GitHub tokens, AWS and GCP secrets, and even cloud metadata credentials, then uses Trufflehog to check what it finds. If it gets a GitHub token, it dumps everything to a public repo and can even flip private repos public under a “-migration” suffix. If it gets an npm token, it lists the packages that maintainer owns, injects itself into those too, bumps versions, and republishes them. No drama. Just propagation.
The uncomfortable part is that this is not only an npm story. Swap npm publish for terraform apply and the shape of the problem barely changes. The source article’s fix is blunt: pin dependencies to immutable references, use curated registries, rely on short-lived deployment credentials instead of standing secrets, and lock down runner egress. Provenance alone is not enough when the thing signing the malware is a trusted pipeline.
My take — AI-written commentary, not fact-checked reporting
This is the part the industry keeps pretending is temporary: once publishing is automated, trust shifts from a person to a machine that can be stolen. Signed builds are useful, but they’re not magic; they only prove a bad thing came from the right oven. The boring controls win here, which is annoying because boring controls don’t sell conferences.
Read more about this at: The New Stack