Shai-Hulud

By GAYINT Staff

Hello my lovelies! Today we are covering the npm drama, caused by a certain strain of wormy being called "Shai-Hulud" after the big wormy in Dune. Apparently beggars can be choosers because this wormy only targets Linux and macOS environments, but it is okay to have standards.

The worm not-so-fren initially was detected on September 8th, caused by a successful targeted phishing campaign against the package maintainer “qix” with a classic “your MFA credentials need to be updated”. The threat actors then used qix’s access that they yoinked to insert their wormy into 18 npm popular packages managed by the maintainer that happened to be used by millions and was live for two hours which was enough for the wormy to be like

At the time of this super gay blog post, the wormy has "spread it" to at least 195 separate packages (including at least 25 of CrowdStrike’s and Google Gemini CLI packages) as developers desperately tried to get GitHub’s attention but they were initially too busy making a shit ton of money off all our code to respond to pleas from all you peasant developers.

Meanwhile, the wormy got busy digging through developers dirty secrets and coin. Like, literally. The malicious code focused mainly on three aspects:

1. Spreading to other repos accessible to the victim using GitHub actions to maintain persistence
2. Looking for those juicy secrets (cloud creds, tokens, passwords etc.) using a legit scanning tool, Trufflehog and dumping them to a new public repo under the victims account called "Shai-Hulud"
3. Hijacking Etherum, Bitcoin, Tron, Litecoin, Solana and Bitcoin transactions in the browser

Thankfully, the threat actor was only after that easy money and this could have been a lot worse and tbh if you were using crypto in your browser… maybe don’t do that.

So far this is the current list of 195 packages (including multiple versions which is why some lists show ≈500) that were impacted:

bundle.js:

• 81d2a004a1bca6ef87a1caf7d0e0b355ad1764238e40ff6d1b1cb77ad4f595c3
• 83a650ce44b2a9854802a7fb4c202877815274c129af49e6c2d1d5d5d55c501e
• 4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db
• dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c
• 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09
• b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777
• de0e25a3e6c1e1e5998b306b7141b3dc4c0088da9d7bb47c1c00c91e6e4f85d6

Exfiltration endpoint: https[://]webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7

Searches you can run:

• gh repo list YOUR_ORG_NAME --limit 1000 --json nameWithOwner\
   --jq '.[].nameWithOwner' | while read repo; do\
   gh api "repos/$repo/branches" --jq '.[] |
   select(.name == "shai-hulud") | "'$repo' has branch: " + .name';\
  done
• https://github.com/search?q=org%3A[REPLACE_WITH_ORG_NAME]%20path%3A**%2Fshai-hulud-workflow.yml&type=code

Malicious workflow file: .github/workflows/shai-hulud-workflow.yml

What do I do?

1. Search for indicators of compromise
2. If detected or vulnerable version found, uninstall, clean npm cache, update to latest uncompromised version, find the malcious bundle.js, rotate secrets, search for ‘shai-hulud’ branches or repos to clean and run an audit.
3. Use tools like Socket’s safe npm, safedep’s pmg or Akido’s SafeChain for future protection




Updated: 17 September 2025