Shai-Hulud 2 and npm secrets theft: what teams need to do

TL;DR: Shai-Hulud 2 is propagating through hundreds of npm packages with trojanised preinstall scripts that steal API tokens, SSH keys, cloud credentials, and environment secrets before exfiltrating them to attacker-controlled GitHub repositories, according to Apiiro. Secret exposure now collapses into pipeline compromise, not just code tampering.

NHIMG editorial — based on content published by Apiiro: Shai-Hulud 2 and npm secret theft across the npm ecosystem

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: What breaks when malicious npm packages execute during CI/CD installs?

A: The main failure is that package installation becomes code execution inside a trusted build context.

Q: Why do developer secrets make supply chain incidents much harder to contain?

A: Because developer secrets often act like non-human identities with broad runtime reach.

Q: How do security teams know when secret sprawl is becoming unmanageable?

A: When they cannot confidently answer where each secret exists, which workloads depend on it, and how quickly it can be retired without breaking business services.

Practitioner guidance

• Block lifecycle script execution in high-trust pipelines Disable or tightly gate npm lifecycle scripts in CI and build environments, especially where dependency installs can reach secrets or signing material.
• Inventory every secret exposed to package installs Map API tokens, SSH keys, cloud credentials, npm tokens, and environment variables that are present during dependency resolution.
• Rotate credentials as a containment action, not a routine task If a compromised package may have run, rotate all affected secrets immediately and rebuild affected systems from trusted sources.

What's in the full analysis

Apiiro's full article covers the operational detail this post intentionally leaves for the source:

• Package-by-package indicators of compromise and the specific npm versions implicated in the campaign
• Step-by-step response guidance for validating whether Bun payloads executed in developer or CI environments
• Concrete repository and workflow artefacts to search for, including structured secret dumps and malicious .github/workflows files
• Apiiro's recommended hardening measures for CI, dependency handling, and secret handling in active delivery pipelines

👉 Read Apiiro's analysis of Shai-Hulud 2 and npm secret theft →

Shai-Hulud 2 and npm secrets theft: what teams need to do?

Explore further

View Full Forum →  |  NHI Foundation Course →