How do I know if my project was hit by Shai-Hulud?

Look for the worm's artifacts: a .github/workflows/shai-hulud-workflow.yml file in your repos (wave one), setup_bun.js or bun_environment.js files in installed packages (wave two), and public GitHub repositories on your account with the description Sha1-Hulud: The Second Coming. Audit npm install activity from September 14 to 16 and November 21 to 24, 2025 against published IoC lists from Unit 42, Wiz, or Datadog. If you find any indicator, treat every credential that machine or runner could read as compromised and rotate it: npm tokens, GitHub PATs, cloud keys, and any API keys in environment variables.

Would a secrets manager have prevented Shai-Hulud credential theft?

Mostly no, and that is the uncomfortable lesson. The worm did not attack any secrets manager. It ran inside the process and the CI runner after the secrets manager had already delivered plaintext values into environment variables, which is exactly where sync-based tools are designed to put them. A secrets manager still helps enormously with rotation speed after the fact, audit trails, and reducing sprawl. But any model that ends with the plaintext key readable by your process was inside the worm's harvest zone.

How do I protect CI from malicious npm postinstall scripts?

Layer the defenses: pin exact versions with a lockfile, enable a package cooldown so brand-new releases age before you install them (pnpm's minimumReleaseAge or equivalent), run installs with ignore-scripts where your stack allows it, use short-lived OIDC-issued cloud credentials in CI instead of long-lived static keys, and scope npm and GitHub tokens as narrowly as possible. Then reduce the prize: the fewer plaintext secrets present in the runner's environment, the less any install-time attacker can take.

Does egress injection make me immune to supply-chain attacks?

No. An attacker who achieves code execution in your process can still do real damage: tamper with your data, abuse whatever access the process legitimately has, and attempt lateral movement. What egress injection changes is the prize. When third-party API keys are injected at the proxy on the way out instead of living in your environment, there is no Stripe or OpenAI key for the malware to exfiltrate, and the scoped proxy token it could steal is revocable and never exposes the underlying vendor key. It removes the highest-value, longest-lived loot from the blast radius; it does not remove the need for the other defenses.

Shai-Hulud: The npm Worm That Proved Your Env Vars Are the Target

What happened: Shai-Hulud is a self-replicating npm worm. In September 2025 it compromised 500+ packages (including CrowdStrike-scoped ones) and harvested credentials at install time. In November 2025 it came back as "The Second Coming," hit packages from Zapier, PostHog, Postman, and AsyncAPI, and published its victims' stolen secrets to 25,000+ public GitHub repositories. The lesson: every credential your process can read, your dependencies can read. The plaintext API keys in your environment variables were the prize both times.

Most breach stories are about someone getting in. Shai-Hulud is a story about what was lying around once something got in — and the answer, on hundreds of thousands of developer machines and CI runners, was everything: npm tokens, GitHub PATs, AWS and GCP keys, and the third-party API keys that power production systems.

Two waves, one design

September 14–16, 2025 — Wave one

The campaign starts with @ctrl/tinycolor, a package pulling roughly 2 million downloads a week, and spreads to 500+ packages, including packages under CrowdStrike's npm scope. A malicious postinstall script runs on install, harvests credentials from the environment, deploys TruffleHog to sweep the disk for more, writes a persistence workflow at .github/workflows/shai-hulud-workflow.yml, and exfiltrates to a webhook.site endpoint. (Unit 42's analysis, Sysdig's breakdown.)

November 21–24, 2025 — Wave two, "The Second Coming"

A renewed campaign lands trojaned versions of hundreds of packages — this time including packages from Zapier, PostHog, Postman, and AsyncAPI — using payloads named setup_bun.js and bun_environment.js. Instead of a webhook, stolen secrets are published to public GitHub repositories branded "Sha1-Hulud: The Second Coming" — Wiz counted more than 25,000 such repos across roughly 350 accounts. (Datadog Security Labs, Microsoft's response guidance.)

December 2025

Researchers spot modified variants testing payloads on the registry. The technique is now a template.

Why it spread: the worm loop

Shai-Hulud's engine is brutally simple. Step one: get one maintainer to install one compromised package — the lifecycle script runs before any of your code, with your user's full permissions. Step two: read the environment and sweep the disk for credentials. Step three: among the loot, find the maintainer's own