Shai-Hulud 2.0 and CVE-2025-62221 sharpen external attack surface risk

At a glance

What this is: FireCompass’s weekly report highlights Shai-Hulud 2.0, CVE-2025-62221, and related attack patterns that show how exposed supply chain paths and exploited endpoints drive real enterprise risk.

Why it matters: For IAM, PAM, NHI, and broader security teams, the report matters because the same exposure patterns that enable supply chain worms and privilege escalation also expose secrets, tokens, and pipeline trust boundaries.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read FireCompass’s weekly report on Shai-Hulud 2.0, CVE-2025-62221, and DDoS TTPs

Context

Shai-Hulud 2.0 and CVE-2025-62221 sit in two different parts of the attack surface, but they point to the same governance gap: exposed credentials and unpatched execution paths can turn ordinary developer and endpoint workflows into compromise paths. In security terms, the problem is not only initial access. It is how quickly access, persistence, and privilege can be compounded once the first weakness is reached.

For identity practitioners, the intersection is real because both supply chain malware and local privilege escalation depend on trust in secrets, tokens, and execution context. That makes this relevant to NHI governance, PAM, and workload identity control, not just application security teams. The starting position in many enterprises is still fragmented and reactive, which is typical rather than exceptional.

Key questions

Q: What breaks when security teams rely on postinstall hooks and broad CI secrets to build npm packages?

A: Postinstall hooks turn package installation into code execution, so any compromised dependency can run immediately on developer laptops and build runners. Broad CI secrets then become easy to harvest and reuse for republishing or persistence. This combination breaks the assumption that installs are passive, and it gives attackers a direct path from dependency compromise to registry abuse.

Q: Why do exposed NHI credentials create such a large blast radius?

A: Exposed NHI credentials create a large blast radius because they are usually tied to service permissions, automation paths, and adjacent cloud resources. A single valid secret can unlock storage, compute, messaging, and administrative actions if the entitlement model is too broad. That is why ownership, scope, and revocation speed matter as much as discovery.

Q: How should security teams reduce malicious package risk in CI/CD pipelines?

A: Use allowlisting, signed artifacts, isolated build runners, and ephemeral credentials that expire after the job completes. Combine that with package provenance checks and install-time behavioural monitoring so that a suspicious dependency has fewer opportunities to harvest secrets or persist.

Q: When should organisations prioritise remediation of known exploited vulnerabilities over routine patch work?

A: When a vulnerability is publicly exploited, internet-facing, or connected to high-value identity paths, it should move ahead of routine backlog work. The goal is to reduce the attacker’s viable window, especially when third-party access or privileged identities could turn that exposure into lateral movement. Prioritisation should reflect exploitability and blast radius, not patch age alone.

Technical breakdown

How npm supply chain worms convert install-time execution into persistence

Shai-Hulud 2.0 uses package install hooks such as preinstall and postinstall to execute code as soon as a developer or build system installs a malicious dependency. From there, the malware enumerates local configuration files and environment variables to locate tokens, cloud keys, and GitHub credentials. The technical trick is not just theft. It is using those secrets to republish packages, create workflow files, and turn the victim’s own CI/CD systems into a propagation channel. That makes pipeline trust, token scope, and runner registration part of the attack surface, not just the build process.

Practical implication: restrict install-time execution, scope CI/CD tokens tightly, and control who can create or modify workflow and runner definitions.

Why local privilege escalation is still a force multiplier on modern endpoints

CVE-2025-62221 is a local authenticated elevation of privilege in the Windows Cloud Files Mini Filter Driver. The driver mediates cloud-synced file operations, so a use-after-free bug can be triggered through crafted I/O sequences and then converted into kernel-level execution. In practice, this means an attacker who already has a low-privilege foothold, often from phishing or another exploit, can move to SYSTEM and disable protections, dump credentials, and expand laterally. The lesson is that endpoint hardening and patching remain essential even when identity controls are strong, because privilege escalation bypasses many perimeter assumptions.

Practical implication: prioritise emergency patching on exposed and high-value endpoints, then verify that EDR tamper resistance and local admin controls still hold.

Why external attack surface management is now an identity control problem

The report links exposed code, self-hosted runners, and unpatched endpoints into a single operational reality: attackers do not respect team boundaries. Once secrets leak, the same credentials can unlock source control, cloud APIs, and deployment infrastructure. That is why external attack surface management now intersects with NHI governance. Machine credentials, API keys, and pipeline tokens are identities with lifecycle, scope, and revocation requirements. When those identities are stored in code, logs, or build artefacts, traditional inventory-based controls lag behind attacker timelines.

Practical implication: treat secrets discovery, token revocation, and runner governance as one lifecycle, not three separate processes.

Threat narrative

Attacker objective: The attacker’s objective is to turn trusted software delivery and endpoint access into a repeatable path for credential theft, persistence, propagation, and enterprise compromise.

1. Entry occurs through a malicious npm package or a low-privilege endpoint foothold, often reaching execution during install time or after an initial user compromise.
2. Credential access follows as the attacker harvests tokens, API keys, GitHub credentials, or local configuration secrets from files and environment variables.
3. Escalation and persistence occur when stolen credentials are used to republish packages, register runners, or elevate to SYSTEM on endpoints, creating a durable execution path.
4. Impact includes supply chain propagation, CI/CD compromise, credential reuse across environments, and in some cases destructive fallback behaviour or full endpoint takeover.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Supply chain malware is now an NHI governance issue, not only an AppSec problem. When malicious packages harvest tokens and reuse them to mutate repositories, the real control failure is unmanaged machine identity lifecycle. Secrets in code behave like credentials with no revocation discipline, which is exactly why NHI governance must extend into build systems and developer workflows. Practitioners should treat package trust as identity trust.

External attack surface management and identity governance are converging. The report’s scenario links exposed secrets, self-hosted runners, and unpatched endpoints into one attacker workflow. That means vulnerability management alone is insufficient when the same exposed path can also yield credential access. The security programme has to see machine identity, code provenance, and endpoint posture as a single chain of control.

Standing privilege remains the easy path from initial access to systemic impact. Once an attacker reaches cloud tokens, GitHub credentials, or local admin-equivalent execution, the environment becomes much easier to propagate through. This is the same pattern seen in many NHI failures: credentials that outlive the task they were meant to support. The field should expect more campaigns that combine secret theft with runner abuse and local privilege escalation.

Pipeline trust is becoming a named attack surface, not an implicit assumption. A useful concept here is pipeline identity drift, where the identity of a build or release path changes faster than governance can track it. When workflow files, runners, and tokens are created opportunistically, control boundaries blur. That makes provenance, approval, and revocation the core policy questions for practitioners.

Attackers increasingly optimise for credential reuse across domains. Once one set of secrets unlocks source control, cloud APIs, and deployment infrastructure, a single compromise can become a broad operational incident. That is why machine identity should be governed with the same seriousness as human privileged access. Practitioners should align programme ownership across AppSec, IAM, and platform engineering.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys.
• From our research: Organisations maintain an average of 6 distinct secrets manager instances, according to The State of Secrets in AppSec.

What this signals

External attack surface programmes now have to account for identity objects that behave like infrastructure. A leaked token, a runner registration path, or an exposed developer endpoint can all serve as the first durable control break. That is why machine identity lifecycle management, not just exposure scanning, will determine how quickly defenders can contain the next supply chain worm.

Pipeline identity drift: build systems increasingly accumulate identities, permissions, and execution paths faster than governance teams can inventory them. The practical response is to connect secrets discovery, runner governance, and patch enforcement into one operational workflow, using MITRE ATT&CK Enterprise Matrix to model the attacker path and control gaps.

For identity-led programmes, the signal is clear: secrets, tokens, and service access in developer platforms must be treated as governed identities with owners, expiry, and revocation rules. Where that discipline is absent, even a small external foothold can become a cross-environment event before incident response teams finish triage.

For practitioners

• Restrict install-time execution in software pipelines Block or review package lifecycle scripts in high-risk repositories and build environments, especially where third-party dependencies can execute during installation.
• Tighten token scope and runner governance Limit GitHub and CI/CD tokens to the minimum required permissions, and require approval for self-hosted runner registration and workflow file changes.
• Inventory and rotate exposed secrets quickly Continuously scan code, logs, and build artefacts for API keys, cloud credentials, and GitHub tokens, then revoke and rotate them as soon as exposure is detected.
• Patch exploitable endpoints by business risk Prioritise emergency deployment of the CVE-2025-62221 fix on developer, admin, and internet-facing Windows endpoints before attackers can chain local escalation.

Key takeaways

• Shai-Hulud 2.0 and CVE-2025-62221 show how modern attacks combine secret theft, persistence, and privilege escalation across different layers of the enterprise.
• The scale of the risk is acceleration, because exposed credentials can be abused in minutes and privileged endpoints can turn a low-level foothold into full compromise.
• Practitioners should manage build systems, machine credentials, and patching as one control chain, because attackers already do.

Key terms

• Supply Chain Worm: A supply chain worm is malware that uses one compromise to propagate into adjacent packages, repositories, or automation systems. In identity terms, it becomes far more dangerous when it can harvest and replay secrets that let it publish, move, or persist without further exploitation.
• Runner Persistence: Runner persistence is the use of CI or build execution infrastructure to retain access after the original malicious artifact is removed. It matters because the attacker no longer depends on the infected package alone and can continue acting through trusted automation assets.
• Local Privilege Escalation Amplifier: A host condition where a local vulnerability becomes far more dangerous because the affected machine already has access to valuable systems. The escalation may be technically local, but the impact becomes organisational when the host can reach signing, deployment, or cloud control planes.
• Pipeline Identity Drift: A governance gap where the identities, permissions, and execution paths used in software delivery change faster than security teams can track them. It often appears in CI/CD, where workflows, tokens, and runners are added informally and outlive their intended purpose.

What's in the full article

FireCompass's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step analysis of Shai-Hulud 2.0’s CI/CD worming behaviour across npm, GitHub Actions, and self-hosted runners.
• Technical breakdown of CVE-2025-62221 exploitation conditions and the privilege escalation path to SYSTEM.
• Operational guidance on how FireCompass frames external attack surface discovery for exposed endpoints and developer infrastructure.
• The report’s incident-response takeaways for organisations dealing with compromised runners, leaked secrets, or active endpoint exploitation.

👉 FireCompass’s full blog includes the technical notes on CI/CD persistence, endpoint exploitation, and DDoS telemetry.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the delivery pipelines and runtime systems that attackers target most often.