Mini shai-hulud and CI/CD secrets: are your controls keeping up?

TL;DR: npm malware targeting CI/CD environments, harvesting GitHub and publishing secrets, abusing GitHub Actions, and propagating through trusted publishing pipelines, with affected packages spanning maintainer workflows and JavaScript infrastructure, is described in Veracode Threat Research on Mini Shai-Hulud. The incident shows that secret sprawl and overprivileged automation turn build systems into distribution channels, not just delivery systems.

NHIMG editorial — based on content published by Veracode: Mini Shai-Hulud, the worm turning CI/CD into an attack surface

By the numbers:

• 4.6% of all public GitHub repositories contain at least one hardcoded secret.
• 38% of secrets incidents in collaboration and project management tools like Slack, Jira, and Confluence are classified as highly critical or urgent.

Questions worth separating out

Q: What fails when CI/CD workflows can access secrets and publishing tokens?

A: The failure is identity collapse inside the pipeline.

Q: Why do CI/CD secrets create such a large blast radius in supply chain attacks?

A: CI/CD secrets are often shared across build, publish, and cloud tasks, so one exposed token can touch many systems at once.

Q: What do security teams get wrong about package provenance and trusted publishing?

A: They often assume provenance replaces older authentication paths automatically.

Practitioner guidance

• Reduce GitHub Actions privilege scope Audit every workflow that can execute untrusted input, especially pull_request_target, and remove access to secrets, package publish rights, and write permissions unless a job genuinely requires them.
• Separate build and publishing identities Use distinct credentials for build, test, and release stages so that a compromised runner cannot automatically publish packages or reuse the same token across multiple environments.
• Rotate publishing tokens and audit runner exposure Rotate npm and GitHub publishing credentials after any suspicious workflow execution, and check whether runners can reach sensitive infrastructure or secret stores beyond the pipeline boundary.

What's in the full analysis

Veracode's full article covers the operational detail this post intentionally leaves for the source:

• Specific malicious workflow patterns, including the GitHub Actions abuse paths observed in the campaign
• The affected npm package list and the evolving indicators tied to the current investigation
• Defensive recommendations for pull_request_target usage, token scope, and runner isolation
• The malware execution detail behind Bun-based payload behaviour and propagation mechanics

👉 Read Veracode's analysis of Mini Shai-Hulud and CI/CD secrets abuse →

Mini shai-hulud and CI/CD secrets: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →