Topic starter
19/08/2026 3:35 pm
TL;DR: Stolen npm tokens and GitHub PATs let the Shai-Hulud campaign keep using trusted access after malicious releases were removed, according to LEGIT Security. Secrets governance has to cover revocation and rebuilds, or package cleanup leaves reusable credentials behind.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: ““Shai-Hulud” npm Attack: Supply Chain Attack Details”.
Key questions
Q: Why do exposed npm tokens and GitHub PATs make supply chain incidents worse?
A: They convert a one-time package compromise into ongoing authority.
Q: What do security teams get wrong about secret scanning after a package compromise?
A: They often treat secret scanning as the end of the response when it is really only discovery.
Q: What breaks when a malicious npm package can read developer secrets during install?
A: The main failure is that package execution inherits identity context it should never need.
Practitioner guidance
- Revoke exposed maintainer and cloud tokens immediately Treat GitHub PATs, npm tokens, and cloud keys from affected environments as compromised until proven otherwise, and revoke them through the same incident workflow that handles code access.
- Rebuild affected projects from clean sources Remove or roll back the malicious package versions, then rebuild from a trusted source or artifact repository rather than from any workspace that may have executed the post-install script.
- Inspect CI/CD runners for secret exposure Review runner inventories, environment variables, and job logs for secrets that were present during the attack window, because build infrastructure may have been the actual credential source.
Bottom line: The attack shows that secret governance fails when credentials remain valid after a malicious package is removed.
Glossary terms: Secrets Governance, CI/CD runner, Package Namespace, Postinstall Script
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
19/08/2026 4:16 pm
Secret governance fails when credentials outlive the package that exposed them. The attack shows that scanning for secrets is only one control layer, because exposed npm tokens, GitHub PATs, and cloud keys remain valid until someone revokes them. In practice, the failure mode is persistent authority, not just secret discovery. That makes lifecycle control the decisive issue for both NHI governance and software supply chain risk.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when package publishing credentials are stolen?
A: Immediately revoke the stolen publishing access, review recent publishes, and rotate every adjacent credential that the compromised identity could reach. Then inspect developer endpoints for persistence, because the attacker may have left backdoors outside the package manager. Response has to cover both registry access and local workstation state.
👉 Read our full editorial: Shai-Hulud npm worm shows why revocation must outlive cleanup
This post was modified 2 days ago by NHI Mgmt Group