NPM Supply Chain Worm: Mini Shai-Hulud Attack Guide for CISOs

Executive Summary

Between April and June 2026, coordinated attackers launched a series of sophisticated supply chain attacks targeting the npm ecosystem, with particular focus on GitHub Actions CI/CD pipeline compromise. The most notable attack — “Mini Shai-Hulud” (also tracked as the hulud supply chain attack and hulud npm worm) — demonstrated critical evolution in supply chain compromise: instead of stealing npm tokens to publish malware, attackers now exploit GitHub Actions workflows to automatically publish signed packages using forged SLSA provenance.

Critical facts for your risk assessment:

• Single attack wave (May 11, 2026) exposed ~520 million cumulative downloads of compromised packages
• Attack velocity reached 639 malicious package versions across 323 packages in one hour (May 19 @antvis campaign)
• Malware targets comprehensive exfiltration of credentials: npm tokens, GitHub PATs, AWS/Azure/GCP credentials, HashiCorp Vault tokens, Kubernetes secrets, database connection strings, and password manager contents
• Downstream impact: 32 compromised Red Hat packages affected thousands of projects; @tanstack/react-router (12.7M weekly downloads) was directly compromised
• Threat actors publicly released attack source code, enabling sustained evolution of the npm supply chain worm and widespread copycat activity
• CISA confirms sap wave campaign activity; vect ransomware group connections remain under investigation

This guide explains technical mechanics, organizational impact, and actionable mitigations grounded in NIST, OpenSSF, CISA, and Snyk authoritative guidance.

What Is NPM and Why It Matters to Your Enterprise

npm (Node Package Manager) is the standard package repository for JavaScript/Node.js libraries. If your organization uses:

• Frontend frameworks (React, Vue, Angular)
• Backend services (Express.js, NestJS)
• Cloud-native tooling (AWS CLI, Kubernetes clients)
• CI/CD orchestration (GitHub Actions, GitLab CI)
• Development tools (Webpack, ESLint, TypeScript, Babel)

…then your supply chain depends on npm packages. The scale is substantial: popular packages receive hundreds of millions of downloads weekly. A single compromised dependency can expose thousands of downstream repos.

Unlike some language ecosystems with mandatory code review gates, npm has relatively loose publication controls: any developer with an npm account can publish packages instantly, with minimal friction between code commit and worldwide availability. This speed-over-security design is the architectural vulnerability the npm worm exploits.

Understanding Mini Shai-Hulud: The Hulud Worm Campaign

Attack Evolution: From Token Theft to Provenance Forgery

“Mini Shai-Hulud” is the informal name for the coordinated npm supply chain worm that peaked in May 2026, beginning with the April 22 Checkmarx/Bitwarden hijacking. The campaign name references a GitHub repository created by attackers — likely a reference to Frank Herbert’s Dune and the creature known as the “sandworm” — apt terminology for an npm worm self-propagating through the supply chain ecosystem.

The hulud campaign marks three critical innovations:

1. OIDC Token Extraction from GitHub Actions – Direct memory scraping of CI/CD runner secrets
2. Forged SLSA Provenance Attestation – Cryptographically valid package signatures without credential theft
3. Mechanized Malicious Publish Operations – 639 malicious package versions in one hour demonstrates automated release workflow manipulation

Named Campaigns and Scale

Technical Breakdown: How the Hulud Worm Operates

GitHub Actions and OIDC Token Exploitation

The most sophisticated attack vector exploits GitHub Actions’ OIDC (OpenID Connect) token functionality.

Attack sequence:

1. Attacker creates malicious pull request targeting open-source project with GitHub Actions CI/CD
2. CI pipeline pulls malicious code; payload executes during build
3. Attacker poisons npm cache with 1.1 GB payload containing credential harvesting code
4. Malware directly reads /proc/<pid>/mem to extract GitHub Actions secrets and OIDC tokens from runner memory
5. Using stolen OIDC token, attacker authenticates to npm registry and publishes new package versions with Sigstore signatures
6. Published packages appear cryptographically legitimate — provenance attestation shows valid signature chain

Critical detail: Stolen credentials are never needed. The OIDC token itself is sufficient for malicious publish operations.

Reference: CISA’s analysis of the sap wave campaign confirms this attack pattern was used to compromise 800+ npm packages in November 2025, escalating the threat timeline significantly.

Malware Families and Credential Exfiltration

Recent malware samples from the hulud campaign employ four distinct payload strategies.

1. Credential Harvester (Primary)

Targets:

• npm tokens (npm_xxx authentication)
• GitHub PATs and SSH keys
• AWS/Azure/GCP service account credentials
• HashiCorp Vault tokens (querying /v1/auth/token/lookup-self)
• Kubernetes service account tokens
• Database connection strings
• Password manager contents (1Password, Bitwarden, pass, gopass)
• Browser cryptocurrency wallets

2. Supply Chain Propagator

• Automatically uses stolen npm tokens to republish legitimate packages under attacker control
• Turns each victim into propagation vector for npm supply chain worm
• Creates self-sustaining infection cycle across dependency trees

3. Infrastructure Persistor

• Establishes long-term C2 using GitHub repositories as dead-drop channels
• Encodes stolen credentials in malicious commit messages and repository descriptions
• Bypasses network-based detection (exfiltration appears as legitimate GitHub traffic)

4. Destructive Tripwire

• If GitHub tokens are revoked, malware executes rm -rf ~/ destroying home directories within 24 hours
• Adds incentive for attackers to maintain access vs. quick exfiltration

Snyk analysis identifies four malware families across 2025-2026 npm campaigns: data exfiltration worms, reverse shell provisioners, Cobalt Strike injectors, and self-propagating worms (the npm worm category).

Sigstore and Provenance Attestation Bypass

The breakthrough in the hulud npm worm campaign was circumventing Sigstore provenance attestation.

Traditional defense (pre-May 2026):

• Package publishers sign releases with private keys
• Consumers verify Sigstore signatures using public keys
• Compromised private key = compromised signature capability

Hulud innovation:

• Attackers use OIDC tokens to authenticate to signing infrastructure
• Signing service generates legitimate Sigstore signatures without private key access
• Provenance attestation appears valid because the OIDC token is legitimately issued by GitHub

Implication: Cryptographic verification alone is insufficient. You must also verify GitHub OIDC token issued-at times and verify they don’t correspond to suspicious GitHub Actions workflow executions.

Risk and Impact: Exfiltration, Malicious Code, and Downstream Cascade

Attack Scale and Credential Exfiltration Scope

The exfiltration scope of malware in the May-June 2026 campaigns was unprecedented:

• 520 million cumulative downloads exposed to potentially compromised packages (May 11)
• 639 malicious package versions in single-hour window (May 19 @antvis)
• 12.7 million weekly downloads for @tanstack/react-router — one compromised package alone
• 32 Red Hat npm package names with 90+ malicious versions targeting enterprise environments

Exfiltration targets beyond traditional credentials:

• HashiCorp Vault tokens (stored in ~/.vault-token)
• Kubernetes service accounts (in-cluster authentication)
• Browser stored cryptocurrency wallets
• Password manager vaults (if unlocked during development session)
• SSH keys with embedded passphrases
• AWS temporary security credentials in ~/.aws/

Snyk Intelligence: Organizations with vulnerable libraries experience 73% higher breach risk. Average time from vulnerability publication to malicious code deployment: 22 days with SCA tools, 87 days without.

The Supply Chain Worm: Self-Propagation Mechanism

The npm supply chain worm operates as a self-propagating infection:

1. Initial compromise: Developer installs malicious package version
2. Credential harvesting: Malware extracts npm tokens, GitHub PATs, etc.
3. Automated release workflow hijacking: Uses stolen credentials to republish other packages
4. Cascade effect: Each compromised developer becomes vector for further supply chain poisoning
5. Amplification: Snyk reports “amplification through downstream dependencies into thousands of projects”

This is distinct from previous npm incidents (event-stream 2018, left-pad). The hulud worm doesn’t require manual attack orchestration — it propagates automatically.

Enterprise-Specific Targeting

Red Hat’s June hulud campaign specifically targeted enterprises:

• Probed GitHub Actions runner memory for secrets
• Queried cloud metadata services (EC2, Azure IMDS, GCP metadata)
• Targeted CI/CD environments where build systems have elevated privileges
• Created “long-term, undetectable access to internal repositories”

Governance Frameworks: NIST, OpenSSF, and CISA Guidance

NIST Secure Software Development Framework (SSDF)

NIST SP 800-218 defines 19 security practices across four groups. For npm supply chain risk, focus on:

PO.1.3 – Dependency Management

• Implement SBOM generation for all npm packages
• Maintain inventory of transitive dependencies
• Track npm tokens and API keys with privilege elevation tracking
• Implementation: 8-12 weeks

PS.3 – Software Bill of Materials (SBOM)

• Generate SBOM in SPDX or CycloneDX format at every release
• Include SHA-1 or stronger hashing for package root integrity verification
• Technical breakdown: 11 minimum SBOM elements per CISA mandate (name, version, supplier, dependencies, timestamps, hashes)
• Implementation: 4-6 weeks

PW.4 – CI/CD Pipeline Security

• Restrict GitHub Actions workflow permissions to minimal scope
• Disable GitHub Actions cache for sensitive credentials
• Implement OIDC token scope restrictions
• Implementation: 6-8 weeks

NIST 90-day implementation roadmap:

• Weeks 1-4: Inventory and SBOM baseline
• Weeks 5-8: GitHub Actions hardening and npm token rotation
• Weeks 9-12: Dependency scanning automation and malicious package detection

OpenSSF Best Practices

The Open Source Security Foundation publishes three guidance frameworks.

OpenSSF Scorecard (23 automated checks):

• Branch protection enforcement
• Signed release verification
• Dependency pinning in lock files
• Secret scanning for exposed tokens
• SLSA level assessment (0-4 scale)

Key metric: Only 10% of npm ecosystem projects implement branch protection; GOLD-tier OpenSSF projects show 73% fewer vulnerabilities.

SLSA Provenance Levels (Levels 0-4):

• Level 0: No provenance (vulnerable to malicious commit injection)
• Level 1: Hosted build platform logs (GitHub Actions logs)
• Level 2: Cryptographically signed provenance attestation
• Level 3: Hardened build environment with isolated runners
• Level 4: Fully isolated build with continuous audit trail

Recommendation: Require minimum Level 2 (signed Sigstore provenance) for critical dependencies.

CISA Known Exploited Vulnerabilities and Shai-Hulud Tracking

CISA maintains Known Exploited Vulnerabilities (KEV) catalog covering 3,100+ vulnerabilities. CISA issued specific advisory on Shai-Hulud worm campaign.

CISA assessment:

• Sap wave campaign confirmed (November 2025 – present)
• 800+ malicious npm packages confirmed
• Vect ransomware group connections under investigation
• Technical breakdown indicates multi-stage attack with 4.29 MB obfuscated dropper

CISA Secure-by-Design Framework (npm focus):

• Require SBOM delivery from all npm package suppliers
• Implement Supply-chain Levels for Software Artifacts (SLSA) Level 2 minimum
• Mandate Sigstore signing for all production releases
• Implement software composition analysis (SCA) with <24 hour response SLA

SSVC Prioritization: CISA’s Stakeholder-Specific Vulnerability Categorization recommends prioritizing vulnerabilities by:

1. Exploitation capability (active in hulud worm ecosystem)
2. Automatable attacks (high — malware is self-propagating)
3. Impact to internal repositories (critical for enterprises)

Malware Families and Payload Analysis

Recognized Malware Categories in NPM Ecosystem

Snyk Intelligence tracks four malware families in npm:

1. Data Exfiltration Worms (e.g., hulud worm)
   • Primary goal: credential exfiltration
   • Self-propagating via stolen npm tokens
   • Obfuscation: 4.29 MB dropper (25x normal size)
   • Persistence: embedded in lifecycle scripts
2. Reverse Shell Provisioners
   • Deploy interactive command shells
   • Target CI/CD environments
   • Establish interactive attacker access
3. Cobalt Strike Injectors
   • Deploy commercial penetration testing framework
   • Enable post-exploitation and lateral movement
   • Typically deployed after initial access established
4. Self-Propagating Worms (e.g., npm supply chain worm)
   • Malware automatically republishes packages
   • Each victim becomes attack vector
   • Creates exponential cascade through dependencies

Obfuscation Patterns

Snyk analysis of malicious code from antvis and Red Hat campaigns identified:

• ROT-based character-code transformation + AES-128-GCM encryption
• Obfuscator.io string-array protection + custom PBKDF2-HMAC-SHA-256 (200,000 iterations)
• Gzip-compressed Base64 blobs + hex-encoded strings
• Runtime deobfuscation preventing static analysis detection

StepSecurity findings: CI/CD-aware malware specifically targets GitHub Actions by:

• Querying GitHub Actions secrets from runner environment
• Reading runner memory for OIDC token extraction
• Detecting container-based execution and adapting payload accordingly

Mitigation Strategies: Governance to Implementation

Immediate Actions (< 72 Hours)

1. Credential Audit and Rotation

• Rotate ALL potentially exposed credentials:
  • npm tokens and npm token authentication keys
  • GitHub personal access tokens (PATs) and SSH keys
  • Cloud provider authentication (GitHub linked accounts)
  • CI/CD platform tokens (CircleCI, Jenkins, GitHub)
• Search GitHub for unauthorized repositories with “Miasma” or “Hulud” descriptions
• Audit GitHub Actions release workflow logs for unexpected executions (May 11-12, May 19, June 1)
• Check for unexpected Bun runtime downloads in CI logs

2. Package Inventory and Rollback

• Identify packages published during attack windows using timestamps
• Cross-reference against known compromised npm package names lists (CISA, Unit42, Snyk)
• Implement 24-72 hour “cooldown” blocking newly published package versions
• Lock additional packages to known-good versions using package-lock.json, yarn.lock, pnpm-lock.yaml
• Verify package integrity using npm audit and cryptographic SHA-1 or stronger hashing

3. Configuration Hardening

• Set ignore-scripts=true in all .npmrc files (disables preinstall/postinstall payload execution)
• Use npm ci instead of npm install in CI pipelines (strict lock file compliance)
• Implement guard rules: require Sigstore provenance attestation verification before installation

Architectural Defenses (Weeks 1-4)

1. Token and Credential Management

• Implement npm token rotation on 30-day schedule minimum (7-day for high-risk environments)
• Use npm “granular tokens” with scoped read-only permissions where possible
• Revoke PAT-based authentication; migrate to OIDC-based GitHub Actions workflows
• Implement secret scanning on all repositories (GitHub Secret Scanning, GitGuardian)
• Audit HashiCorp Vault token access logs for unusual patterns

2. GitHub Actions Hardening

• Restrict GitHub Actions workflow permissions to explicit allow-list (no blanket contents: write)
• Disable GitHub Actions cache for workflows handling credentials
• Restrict OIDC token generation to specific workflows using environment constraints
• Implement GitHub repository-level secrets minimization (move to Vault)
• Add manual approval gates for release workflow execution

3. Dependency and Package Security

• Route ALL npm traffic through private registry proxy (Artifactory, Nexus, npm private)
• Implement namespace shadowing to prevent dependency confusion
• Generate and maintain SBOM for every release (SPDX or CycloneDX format)
• Implement automated scanning for known-malicious packages (CISA KEV, Snyk vulnerability database)

Strategic Governance (Months 1-3)

1. Framework Implementation: NIST SSDF + OpenSSF + CISA

2. Supply Chain Contracts

For critical npm package suppliers (millions of weekly downloads):

• Require SBOM delivery and version-level transparency
• Contractual disclosure obligations (24-hour incident notification)
• Audit rights for GitHub repository security practices
• Require multi-factor authentication for all maintainer accounts
• SLA for critical vulnerability release (48 hours maximum)

3. Continuous Monitoring and Detection

• Behavioral analytics for unusual npm token usage (mass package publishes, unexpected registry endpoints)
• Monitor GitHub for unauthorized repository creation by service accounts
• Threat intelligence feeds (Unit42, Microsoft SIRT, Snyk, CISA)
• Automated malicious package detection using malware signatures and behavioral analysis

Key Takeaways for Risk Communication

1. The Attack Surface Has Fundamentally Expanded

Traditional npm risks (typosquatting, abandoned packages) are now compounded by sophisticated supply chain worm campaigns with OIDC exploitation and forged Sigstore signatures.

2. Speed Is the Defining Characteristic

639 malicious package versions in one hour. Detection and response windows are measured in minutes. Automated tooling, not manual orchestration, defines this threat.

3. Your Risk Extends to Transitive Dependencies

CISA confirms thousands of projects affected by 32 compromised npm packages. Visibility into your full dependency tree (via SBOM) is now critical.

4. Token-Based Defense Is Necessary but Insufficient

Credential rotation remains essential, but OIDC-based attacks bypass traditional npm token security. CI/CD hardening is now a primary control.

Resources and References

Primary Sources:

• Unit42 Palo Alto Networks: “Monitoring NPM Supply Chain Attacks”
• Microsoft Security Blog: “Preinstall Persistence Inside Red Hat NPM Miasma Credential Stealing Campaign”

Authoritative Frameworks:

• NIST Secure Software Development Framework (SP 800-218)
• OpenSSF Best Practices Badge & Scorecard
• CISA Supply Chain Security Guidance
• CISA KEV Catalog

Governance and Ecosystem:

• NCSC Supply Chain Security Guidance
• Snyk State of JavaScript Security Report
• npm Official Security Documentation

Previous Analysis:

• Arcseer: “From left-pad to Mini Shai-Hulud: A Decade of NPM Supply Chain Attacks”