A devastating self-propagating npm supply chain worm has compromised over 800 packages, including the keyv library. The malware targets developer tools, exfiltrates AWS and Kubernetes secrets, and installs a destructive dead-man's switch.
An unauthorized GitHub account compromise targeting a key Node.js utility maintainer has triggered a self-propagating software supply chain worm across the npm ecosystem, contaminating over 800 packages with massive downstream distribution. The attacker bypassed standard branch protections to push malicious files directly to the main branch of libraries like keyv, cacheable, and flat-cache. Because these malicious commits triggered legitimate release workflows, the poisoned packages were published to the npm registry with valid GitHub Actions provenance signatures. This severe compromise allowed the payload to bypass automated supply chain security verification tools, turning trusted open-source caching libraries into high-velocity distribution vectors for a credential-stealing worm.
The Shai-Hulud malware campaign executes a highly sophisticated, multi-stage attack chain designed to harvest critical infrastructure secrets, maintain persistent access in developer environments, and spread laterally to other software packages. To fully secure an enterprise environment, security engineers must understand the exact technical execution of this supply chain threat.
The entry point for this attack relies on a compromised maintainer account pushing malicious updates to npm. In every poisoned package, the attacker inserted two files: setup.mjs and Math_Symbol.js. The attacker also modified the package.json configuration file, adding a preinstall hook that automatically runs the setup script: node setup.mjs. When a developer or a continuous integration pipeline executes an installation command, the system automatically triggers the execution of the obfuscated setup.mjs dropper prior to package resolution.
The primary role of the setup.mjs dropper is to establish a secure runtime execution environment that bypasses standard Node.js monitoring, behavioral endpoint analysis, and static inspection tools. To achieve this, the dropper queries the host for the Bun JavaScript runtime. If Bun is absent, the script silently downloads a standalone Bun binary from its official release repository on GitHub. Once downloaded, the script uses the native process execution command to spawn the secondary payload, Math_Symbol.js, within the Bun environment. Running the payload through Bun allows the malware to execute advanced system calls and hide its footprint from standard Node.js security hooks.
The core payload, contained within the heavily obfuscated 728 KB Math_Symbol.js file, implements a series of aggressive credential extractors tailored for different storage layers:
npm Registry Tokens: The malware reads the local .npmrc configuration file at the user home directory and scans the active workspace for other instances. It extracts the auth tokens and verifies them live against the official npm registry registry.npmjs.org to ensure they are active before exfiltration.
GitHub Access Tokens: The payload searches for classic personal access tokens, OAuth tokens, GitHub App server-to-server tokens, and JSON Web Token OpenID Connect tokens. It extracts these credentials from configuration files like hosts.yml, active environment variables, and direct filesystem searches. On GitHub Actions runners, the payload goes a step further by executing a specialized command to dump the worker runner process memory directly, harvesting the active actions token and URL.
Cloud Provider Infrastructure Secrets: The scanner targets AWS credentials in config and credentials files, harvesting active profiles. It attempts to query the local EC2 Instance Metadata Service using IMDSv2 and falls back to IMDSv1 if needed. It also checks ECS container metadata endpoints and attempts to enumerate AWS Secrets Manager secrets across multiple cloud regions.
Kubernetes and HashiCorp Vault Keys: The script attempts to read the service account token, certificate authority file, and namespace directly from the default service account directory. It uses these stolen tokens to query the Kubernetes API for active secrets. Additionally, the malware scans environment variables, configuration files, and container paths for Vault tokens, subsequently enumerating and reading all accessible key-value secret stores.
Generic Workspace Scans: Using over 200 platform-aware glob patterns, the scanner hunts for environment files, private keys (such as PEM and SSH keys), Terraform state files, Docker registry configurations, KeePass databases, and virtual private network profiles.
A unique aspect of the Shai-Hulud campaign is its focus on modern engineering tools. The payload specifically targets development workspace configuration directories to ensure persistent execution:
Visual Studio Code Exploitation: The malware modifies the local workspace configuration, writing a malicious execution task inside the tasks.json file in the VS Code folder. This task is configured to execute automatically when the workspace folder is opened by a developer, creating silent local persistence.
Claude Code Integration: The malware writes configuration files directly to the settings directory of local Claude Code setups and drops a secondary copy of the script in the local directory. This targets active AI coding assistants, triggering code execution during automated context-building or routine refactoring tasks.
If the harvested npm tokens possess publishing permissions, the malware initiates its worm-like distribution mechanism. It automatically identifies all packages owned or maintained by the compromised user identity, injects the malicious preinstall hooks and scripts into their codebases, and publishes a new patch version to the public registry. This automated propagation cycle is responsible for the rapid spread of the worm to hundreds of downstream packages within hours of the initial breach.
Attacker hijacks 'jaredwray' GitHub account
Direct commits to main trigger Actions-signed release
npm install triggers preinstall hook running setup.mjs
Downloads standalone Bun v1.3.13 to execute payload
Extracts npm, GitHub, AWS, Kubernetes, and Vault credentials
Infects & publishes downstream packages using stolen npm tokens
Dead-man's switch wipes workspace if tokens are revoked
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
A newly identified malware campaign named ChocoPoC is targeting cybersecurity researchers and enterprise vulnerability management teams. By burying malicious PyPI transitive dependencies in proof-of-concept exploit repositories, the threat actors execute remote commands and exfiltrate browser credentials.
June 24, 2026
A substantial data leak involving Be Call Group, a contact center BPO partner of TIGO Colombia, has exposed 1 GB of data containing 9.7 million records and direct connection credentials. Discover how attackers abuse third-party trust relationships and how to protect your enterprise network.
Unauthorized actors successfully leveraged compromised third-party contractor credentials to access administrative systems of a major Canadian wireless telecommunications carrier. We analyze the attack mechanics of these supply chain breaches, mapping behaviors to the MITRE ATT&CK framework.
Supply chain attacks demonstrate how vulnerable modern development environments are to lateral compromises. Securing an enterprise software pipeline requires continuous vigilance, strict access controls, and regular offensive testing. Implementing automated build validation and restricting script execution are critical first steps, but organizations must also look for broader indicators of digital exposure.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
For deep, continuous validation of your software assets and infrastructure, contact Femto Security today. Our expert offensive security teams deliver tailored solutions to secure your enterprise pipelines and protect your organization from complex supply chain threats.
For organizations operating across the Gulf Cooperation Council (GCC) region, the risk of a software supply chain compromise is severe. Businesses in Dubai, Riyadh, and Doha are rapidly advancing their digital services, heavily relying on automated cloud-native pipelines, containerized environments, and external open-source libraries. A single developer installing a compromised dependency like keyv can expose the entire enterprise infrastructure to unauthorized entry.
The exfiltrated credentials, including AWS keys, Kubernetes secrets, and Vault tokens, give threat actors immediate access to critical production environments, private databases, and continuous integration pipelines. This exposure poses a major threat to corporate compliance frameworks. Organizations seeking alignment with national regulatory standards, PCI-DSS, or SOC 2 must establish strict validation processes to ensure malicious dependencies are blocked before they reach production networks.
If your organization utilizes automated deployment pipelines, verifying your external packages is critical. Enterprise entities must proactively analyze their application codebases. Engaging a professional team for a thorough Source Code Review can identify hidden lifecycle scripts, hardcoded secrets, and backdoored dependencies in your primary repositories.
Containing a Shai-Hulud infection requires strict operational coordination due to a destructive defense mechanism integrated by the threat actors: a local dead-man's switch. The malware installs a background watcher process that continuously monitors the validation state of the stolen API keys and tokens. If an incident response team immediately revokes a compromised token without cleaning the local development endpoint first, the watcher process detects the revocation and triggers a local destructive command, wiping the entire workspace and local files.
To safely isolate and contain this threat, security teams must follow a structured response playbook:
Immediately disconnect any suspected developer workstation, virtual desktop, or continuous integration runner from the local network. Do not execute credential revocation commands globally until the physical or virtual host has been fully isolated from the internet to block any outbound exfiltration or monitoring checks.
Inspect active running processes on the isolated machine to locate and terminate any unauthorized background execution tasks checking token validation states. Search for and delete malicious configurations in the workspace settings, specifically auditing the VS Code tasks and Claude Code configurations. Remove the setup.mjs, Math_Symbol.js, and math_init.js files from all directories.
Once the local host is completely cleaned and isolated, execute a comprehensive rotation of all potentially exposed credentials from a separate, secure administration workstation. This includes rotating AWS access keys, GitHub personal access tokens, npm publishing keys, Kubernetes configurations, and Vault access tokens.
To prevent future occurrences similar supply chain attacks, enforce policies to ignore package lifecycle scripts during installations. Configure your package manager to disable script execution globally on developer systems and build runners. This simple configuration prevents malicious preinstall hooks from executing automatically during installation workflows.
Additionally, keeping an up-to-date map of your external-facing systems and software assets is crucial. Organizations should employ continuous Attack Surface Management to monitor exposed endpoints and identify vulnerable deployment servers before attackers can exploit them.
