Shai-Hulud

ChainDrop is a self-propagating npm worm that infected over 400 packages, including widely used ones like keyv and cacheable-request, enabling it to steal cloud credentials, npm and GitHub tokens, SSH keys, and other sensitive developer data. The worm uses a combination of domain-based and GitHub-based exfiltration, with C2 infrastructure resolved via an Ethereum smart contract, allowing silent domain rotation through blockchain transactions. It establishes persistence through VS Code and Claude Code configurations, targets CI runners to extract ephemeral OIDC tokens, and can republish infected packages while preserving legitimate functionality, making detection difficult.

In H1 2026, a surge in cloud-based threats was driven by aggressive software supply-chain attacks, particularly by the group TeamPCP, which compromised developer toolchains across npm, PyPI, and VSCode extensions to steal credentials and propagate across cloud environments. TeamPCP's malware evolved to exploit CI misconfigurations, extract OIDC tokens, and deploy wipers with Dune-themed taunts. North Korea's UNC1069 conducted parallel campaigns, trojanizing the axios package and compromising over 140 @mastra-related packages. The open-sourced Shai-Hulud worm enabled follow-on attacks like IronWorm, which used Rust-based binaries and eBPF rootkits for stealth. A new extortion group, JINX-0163, emerged, targeting cloud identities across AWS, Azure, and GCP to steal secrets and enable ransom threats via the alias 'FulcrumSec'.

Unit 42 has identified a growing threat called 'token jacking,' where cybercriminals steal API keys (tokens) used to access AI platforms, leading to massive financial losses due to unmonitored usage. These stolen tokens are often funneled into 'transfer stations'—gray-market services that resell discounted AI computing capacity—using proxy platforms like new-api or one-api. Attackers obtain tokens via phishing, information stealers, or malicious npm packages such as Shai-Hulud and Miasma, which self-propagate and harvest credentials from development environments. The stolen tokens are then used to generate millions of API calls, resulting in hundreds of thousands of dollars in unauthorized charges before detection.

A massive supply-chain attack dubbed ChainDrop has compromised over 1,300 npm packages with a combined 2 billion monthly downloads. The attack began with the compromise of the Keyv maintainer's GitHub account, allowing the threat actor to push malicious code directly to main branches and publish poisoned versions through legitimate CI/CD workflows. The malware, named ChainDrop and based on the Shai-Hulud worm, includes a dropper (setup.mjs) and an obfuscated infostealer (Math_Symbol.js) that collects developer and cloud credentials, encrypts them, and exfiltrates them to a public GitHub repository. The attack spreads laterally by self-propagating to other packages maintained by developers whose environments were infected.

Threat actors are increasingly targeting GitHub Actions secrets through campaigns like GhostAction and Megalodon, which exfiltrated thousands of secrets from public repositories. These attacks exploit the accumulation of unused, stale, or long-lived credentials that organizations fail to clean up. The Shai-Hulud worm exemplifies the risk, spreading by stealing npm tokens to publish malicious packages. Transitioning to OIDC-based authentication and eliminating unused secrets can reduce the attack surface significantly.

AI music generator Suno suffered a breach stemming from the Shai-Hulud worm, which compromised a developer's machine and exfiltrated GitHub and cloud credentials. The attacker, using the handle ellie.191, accessed Suno's source code, customer data, and payment information without the company's public notification. The breach highlights the ongoing impact of the Shai-Hulud campaign, which spreads via trojanized npm, PyPI, and Packagist packages and exfiltrates credentials to public GitHub repositories.

The Java ecosystem is increasingly targeted by supply chain attacks, as demonstrated by the Shai-Hulud worm's second wave and a malicious lookalike of the Jackson JSON library published to Maven Central. These attacks leverage compromised or freshly published dependencies to deliver payloads such as Cobalt Strike, exploiting the window between publication and detection. Traditional vulnerability scanners are often too slow to respond, making real-time protection critical. StepSecurity now extends its Maven support to GitHub Checks and OSS Package Search to block compromised and newly published malicious Java dependencies during pull requests.