Topic starter
10/12/2025 1:40 pm
TL;DR: Shai-Hulud spread through the npm ecosystem by harvesting static secrets, republishing poisoned packages, and using stolen credentials to extend the compromise across developer and CI/CD environments, according to Defakto Security. The incident reinforces that rotation alone cannot fix standing privilege when credentials persist across pipelines, logs, and repos.
Editorial analysis by NHI Mgmt Group, based on content published by Defakto Security: “Shai-Hulud npm Supply Chain Attack: Why Secrets Fueled the Worm”.
Key questions
Q: What breaks when CI/CD pipelines rely on static secrets?
A: Static secrets create a reusable attack path into production infrastructure.
Q: Why do reusable credentials increase supply chain risk in build systems?
A: Reusable credentials remain valid long enough to be copied, cached, logged, or exfiltrated.
Q: How do security teams know whether secret rotation is actually working?
A: Rotation is working only if exposed credentials are found quickly, revoked everywhere they are used and replaced before attackers can reuse them.
Practitioner guidance
- Eliminate long-lived npm publish tokens Replace durable publish credentials with runtime-issued identities that exist only for the publishing task and expire automatically when the job completes.
- Audit secret exposure across build paths Search package scripts, CI logs, environment variables, and developer workstations for reusable credentials that can be copied and replayed.
- Scope non-human access to single tasks Limit each workload credential to the exact repository, registry, and publish action it needs so compromise cannot be reused for lateral propagation.
Bottom line: Shai-Hulud showed that static secrets can turn a single package compromise into rapid supply chain propagation across npm and CI/CD environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 3 times by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:35 pm
Static secrets are a supply chain liability, not a convenience layer. The Shai-Hulud worm succeeded because reusable credentials were already embedded across build and developer environments. That means the security failure is not only compromise, but the decision to let non-human access persist in forms that can be copied and replayed. The practitioner implication is that any programme still depending on static publish tokens is preserving its own attack surface.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do first when package signing or publishing secrets are exposed?
A: Contain the exposure by revoking the affected credentials, then remove any workflow that still depends on those long-lived secrets. After that, replace the publishing path with ephemeral identity so the same secret cannot be stolen and replayed in the next build or install cycle.
👉 Read our full editorial: Shai-Hulud shows why static secrets still break npm supply chains