Topic starter
17/08/2026 5:39 pm
TL;DR: Unosecur says a Shai-Hulud-style npm supply chain attack used malicious pre-install scripts to harvest cloud credentials, GitHub tokens, and CI/CD secrets, then pushed the stolen data into more than 25,000 attacker-controlled repositories. The incident shows that dependency trust is now an identity problem because compromised credentials can move across pipelines, cloud accounts, and GitHub with little friction.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Shai-Hulud 2.0: Responding to the 2025 npm Supply Chain Attack”.
By the numbers:
- The attack ran between November 21 and 23, 2025.
Key questions
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do CI/CD secrets create more risk than many teams expect?
A: CI/CD secrets often have broad blast radius because they can authenticate to source control, cloud platforms, package registries, and deployment systems.
Q: What are the signs that a software supply chain attack through GitHub may already be in progress?
A: Warning signs include unsolicited contact from unfamiliar accounts, invitations to collaborate on suspicious projects, requests to clone and run external repositories, and unexpected package installs during execution.
Practitioner guidance
- Remove install-time secret exposure from build paths Keep cloud keys, GitHub tokens, and CI/CD credentials out of environments where npm lifecycle scripts can execute.
- Audit package installation for lifecycle-script abuse Review npm workflows for pre-install execution, unexpected postinstall hooks, and scripts that run before code review or scanning can intervene.
- Rotate every credential exposed in the install path Revoke and replace cloud provider keys, GitHub tokens, CI/CD variables, npm publish tokens, and SSH keys that may have been reachable during the compromise window.
Bottom line: The incident shows how a malicious npm install can become a secrets theft event when build systems still hold reusable machine credentials.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Timeline detail on how the malicious npm versions propagated between November 21 and 23, 2025
- Specific examples of the GitHub workflow backdoor and self-hosted runner abuse
- Identity posture guidance for mapping leaked tokens to cloud roles and automation accounts
- Cleanup steps for revoking access keys, npm tokens, and GitHub credentials after exposure
👉 Read Unosecur's analysis of the Shai-Hulud 2.0 npm secrets exfiltration campaign →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 5:40 pm
Secrets sprawl is now a supply chain exposure problem, not just a vaulting problem. This campaign shows that credentials stored in CI/CD variables, local config files, and developer environments remain reachable to malicious package code long before a vault control can help. The governance gap is where build-time execution still has access to identity material that should have been isolated from package installation. Practitioners need to treat secret placement as part of software supply chain risk management, not as an afterthought.
A few things that frame the scale:
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Should teams prioritise secret rotation or build hardening after an npm worm event?
A: They should do both, but rotation comes first for any credential that may already have been exposed. Build hardening reduces the chance of repeat compromise, while rotation cuts off immediate reuse paths across cloud, GitHub, and automation systems. If you delay rotation, the attacker keeps the highest-value part of the breach.
👉 Read our full editorial: Shai-Hulud 2.0 turns npm installs into a secrets exfiltration channel