Notifications
Clear all
Topic starter
02/08/2026 12:13 pm
TL;DR: Shai-Hulud 2.0 weaponises npm lifecycle hooks, compromised maintainer accounts, workflow injection, IMDS theft, and SCM persistence to turn CI/CD into an identity-theft channel, according to Cymulate Research Lab. The attack shows that build systems now need identity controls as tightly governed as production access because trust assumptions collapse inside the pipeline.
NHIMG editorial — based on content published by Cymulate: Shai-Hulud 2.0 and npm supply chain identity theft in the SDLC
By the numbers:
- The simulation includes more than 12 new attack scenarios now available in Cymulate Exposure Validation.
Questions worth separating out
Q: What breaks when npm package installs are allowed to execute code before inspection?
A: The control point disappears.
Q: Why do CI/CD pipelines create non-human identity risk?
A: CI/CD pipelines create non-human identity risk because they authenticate to other systems, carry secrets, and perform privileged actions automatically.
Q: What do security teams get wrong about secret rotation?
A: They often treat rotation as a substitute for removing the underlying credential model.
Practitioner guidance
- Inventory install-time execution paths Map every npm preinstall and postinstall script, then require approval or sandboxing for packages that can execute during installation.
- Constrain cloud metadata access from build runners Block unnecessary access to Instance Metadata Service endpoints from CI/CD containers and developer workstations.
- Separate workflow write access from secret read access Use distinct identities for repository maintenance, workflow changes, and secret access so a single compromised token cannot create persistence and exfiltration together.
What's in the full article
Cymulate's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step simulation flows for the preinstall hook, workflow injection, and IMDS credential theft paths.
- Scenario-level output examples showing how the payload behaves in developer machines, CI runners, and cloud instances.
- Detection engineering content including EDR rules, Sigma detections, and mitigation text for build and SCM abuse.
- More than 12 attack scenarios in Cymulate Exposure Validation for testing the attack chain end to end.
👉 Read Cymulate's analysis of Shai-Hulud 2.0 npm supply chain identity theft →
Shai-Hulud 2.0 and npm identity theft: what IAM teams missed?
Explore further
02/08/2026 1:16 pm
Build pipelines are now identity systems, not just delivery systems. Shai-Hulud 2.0 shows that package installation, CI execution, cloud role assumption, and repository write access now sit on the same trust path. That collapses the old separation between code security and identity governance. Practitioners should treat build infrastructure as an identity domain with its own lifecycle, privilege model, and abuse paths.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How should teams respond when a package compromise creates workflow persistence?
A: They should isolate the workflow and runner control plane before the attacker can reuse it. That means revoking suspicious tokens, removing unauthorized GitHub Actions files, checking self-hosted runner registrations, and reviewing cloud role usage for evidence of metadata abuse. Containment must include SCM, CI, and cloud identity together.
👉 Read our full editorial: Shai-Hulud 2.0 shows how npm supply chain attacks steal identities
