Notifications
Clear all
Topic starter
19/08/2026 3:35 pm
TL;DR: Malicious npm releases tied to the Shai-Hulud campaign harvested environment secrets, GitHub PATs, npm tokens, and cloud credentials, then used a worm-like publishing loop to spread through maintainer namespaces and CI/CD pipelines, according to LEGIT Security. The incident shows that secret scanning without revocation, rebuild discipline, and package provenance controls leaves a persistent compromise path.
NHIMG editorial — based on content published by LEGIT Security covering the Shai-Hulud npm supply chain attack: malicious npm packages, secret harvesting, and worm-like propagation
By the numbers:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when secrets are stored in code and CI/CD tools?
A: Access becomes invisible, reusable, and hard to revoke, which means the organisation loses control of where authentication material exists.
Q: Why do stolen developer and publishing tokens create longer-lived risk than malware alone?
A: Because tokens behave like reusable identities.
Q: What do security teams get wrong about private repositories and internal pipelines?
A: They often assume private means protected.
Practitioner guidance
- Revoke exposed tokens immediately Treat npm tokens, GitHub PATs, and cloud keys as compromised if they were present on an affected machine, runner, or maintainer account.
- Rebuild from clean sources and artefacts Remove tainted package versions, then rebuild affected projects from a trusted source repository and artifact store.
- Inventory maintainer-scoped NHIs Map which service accounts, publishing tokens, and developer credentials can publish packages or modify workflows.
What's in the full analysis
LEGIT Security's full article covers the operational detail this post intentionally leaves for the source:
- A full list of impacted npm packages and versions so teams can validate their own dependency inventories.
- Specific detection and response steps for identifying the Shai-Hulud repository and reviewing its contents for leaked secrets.
- Practical guidance on rebuilding compromised projects from clean sources and artifact repositories.
- The vendor's notes on using secrets scanning to identify which credentials should be revoked first.
👉 Read LEGIT Security's analysis of the Shai-Hulud npm supply chain attack →
Shai-Hulud npm worm: what secret governance gaps should teams close?
Explore further
19/08/2026 4:16 pm
Secret exposure has become an identity lifecycle failure, not just a detection problem. Scanning can tell you that a credential was exposed, but it does not end the risk unless revocation, rebuild, and scope reduction happen quickly. The article shows a classic NHI governance gap: secrets are still treated as static by-products of development rather than managed identities with a lifecycle. Practitioners should treat exposure as the start of an access decision, not the end of an incident.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- Internal repositories are 6x more likely to contain secrets than public ones, which is why private build systems remain high-value targets for credential harvesting.
A question worth separating out:
Q: How should organisations respond when a package they trust is suddenly compromised?
A: Block the affected package immediately, identify every environment that installed it, and verify whether any secrets, tokens, or browser sessions were exposed. Then review publishing identities, CI permissions, and any downstream systems that could have inherited the compromise.
👉 Read our full editorial: Shai-Hulud npm worm exposes the weak link in secret governance
