Topic starter
02/08/2026 12:16 pm
TL;DR: Shai-Hulud v2 has affected 525+ npm packages and 132 million monthly downloads, with new behaviour that steals secrets and adds GitHub Actions persistence, according to Semgrep and Aikido. The incident shows that leaked secrets, token scope, and runner trust assumptions now create a combined supply chain identity problem, not just a malware problem.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “Sha1-Hulud: The Second Coming of the NPM Worm is Digging For Secrets”.
By the numbers:
- 525+ packages have been affected by the Shai-Hulud v2 wave.
- 132 million monthly downloads were tied to the affected package set.
Key questions
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do npm tokens and build credentials increase supply chain risk so quickly?
A: Because they are reusable non-human identities with privileges that outlive a single session.
Q: What are the signs that a CI/CD runner has been used as persistence?
A: Look for unfamiliar workflows, new repository-level automation, unusual runner registration activity, and logs showing self-hosted execution tied to suspicious repository events.
Practitioner guidance
- Audit package publishing tokens for scope creep Map which npm tokens can publish, modify metadata, or touch multiple packages, then separate routine developer access from release authority and remove unnecessary workflow scopes.
- Review self-hosted runner trust paths Inventory runners that accept repository-triggered jobs, inspect workflow files for command injection exposure, and isolate runners that can execute code from untrusted repository content.
- Rotate exposed cloud and developer secrets Treat AWS, GCP, Azure, GitHub, and npm credentials as compromised if they were present on affected machines or in repositories touched by the worm.
Bottom line: Shai-Hulud v2 shows that npm compromise becomes much more dangerous when package install, token scope, and runner trust are managed as separate problems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:18 pm
Supply-chain identity is now the control plane, not a side effect: This worm succeeds because package publishing, secret storage, and runner execution are treated as separate governance problems. They are not separate at attack time. The operational conclusion is that npm maintainers, CI runners, and cloud tokens form one identity system, and the weakest trust decision in that chain defines the blast radius.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should teams respond when a tainted package may have touched production-connected secrets?
A: Assume the affected environment is exposed, isolate it from sensitive systems, revoke credentials that were reachable from that host or runner, and inspect for persistence before restoring trust. The response priority is credential containment first, then host cleanup, then rebuild from verified artifacts. Waiting for proof of theft usually wastes the containment window.
👉 Read our full editorial: Shai-Hulud npm worm v2 exposes the identity gaps in supply chains