Notifications
Clear all
Topic starter
19/08/2026 3:28 pm
TL;DR: A new Shai-Hulud wave used npm preinstall hooks, Bun runtime downloads, and obfuscated payloads to steal credentials from four SAP-ecosystem packages, then spread through GitHub and npm tokens, according to StepSecurity research. The attack shows that package provenance, CI/CD secrets, and AI coding-agent persistence now need to be governed as one control surface.
NHIMG editorial — based on content published by StepSecurity: A Mini Shai-Hulud Has Appeared: Obfuscated Bun Runtime Payloads Hit SAP-Related npm Packages
Questions worth separating out
Q: What breaks when a malicious npm package can read developer secrets during install?
A: The main failure is that package execution inherits identity context it should never need.
Q: Why do stolen CI tokens and publishing tokens create such a large blast radius?
A: Because they are non-human identities with operational authority, not just authentication artifacts.
Q: What do security teams get wrong about AI coding-agent persistence?
A: They often treat IDE and agent configuration as workspace convenience rather than execution surface.
Practitioner guidance
- Block install-time code execution by policy Enforce controls that flag or block preinstall and postinstall hooks for newly introduced or recently published npm packages, especially in CI/CD and privileged developer environments.
- Split publishing and build credentials Use separate non-human identities for package publishing, repository administration, and CI execution.
- Scan repositories for persistence files Add detection for .claude/settings.json, .vscode/tasks.json, and similar developer-tooling artifacts in source control.
What's in the full analysis
StepSecurity's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step runtime trace from Harden-Runner showing how the malicious preinstall hook executed inside GitHub Actions.
- Decoded loader and payload analysis, including how Bun was used to evade common Node.js monitoring paths.
- Exact repository injection behaviour, including the workflow branch names and commit patterns used to persist and spread.
- Cleanup guidance for specific compromised package versions and affected developer machine estates.
👉 Read StepSecurity's analysis of the SAP-related Shai-Hulud npm supply chain attack →
Shai-hulud npm supply chain attack: what SAP teams need to check?
Explore further
19/08/2026 4:12 pm
Shai-Hulud has become a governance pattern, not just a malware name. The important shift is that package compromise now combines registry trust, CI/CD secrets, and developer workspace persistence in one chain. That means organisations cannot treat npm hygiene, secret rotation, and endpoint controls as separate programmes when the attacker can move across all three in a single install. The practitioner conclusion is to govern package execution as identity security.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when a poisoned package steals secrets from a build environment?
A: Accountability usually spans platform engineering, security, and the owners of the credential-bearing workflow. If developer tools can bypass central controls, the governance failure is shared. Frameworks such as NIST CSF and NIST SP 800-53 push organisations toward clearer control ownership, especially where machine credentials and software supply chains overlap.
👉 Read our full editorial: Shai-hulud npm malware now targets SAP-related package pipelines
