Mini Shai-Hulud attacks npm again: 317 packages poisoned in 22 minutes
The attacker released 637 malicious versions through npm in 22 minutes, affecting 317 npm packages. The malicious payload uses Bun scripts, GitHub API as the C2 channel, and contains Docker container evasion capabilities. It is one of the largest supply chain attacks this year.
Core conclusion
On May 19, 2026, attackers used the same malware framework previously used in SAP attacks to publish 637 malicious package versions through npm, affecting 317 npm packages. The entire attack process only took 22 minutes, using automated batch release.
Key Points
- Time of incident: May 19, 2026
- Affected scope: 317 npm packages, 637 malicious versions, 2 waves of automated attacks
- Attack method: Publish a malicious version through stolen npm token and execute obfuscated Bun script -Affected objects: All Node.js developers and CI/CD pipelines using npm as package manager
Background and attack details
This is the second large-scale operation in the "Shai-Hulud" series of attacks. The same malware framework was used in this attack by the same attackers who targeted the SAP ecosystem three weeks ago:
- Requirements for same Bun runtime
- Same hex-variable obfuscation mode
- Same scanner architecture (100KB refresh threshold)
- Regular matching set for the same credentials
The attack chain is divided into two layers of execution paths. Each compromised version embeds execution code in a preinstall or postinstall hook, triggering a 498KB obfuscated Bun script. This script is executed when dependencies are resolved - npm's semver resolver will pull the latest version, even if it was released only a few hours ago.
Scope of Impact:
- 309 packages received 2 malicious versions each (1 in each wave)
- 4 packages received 3 malicious versions (probably early testing)
- 637 malicious versions in total
Attack ability matrix
| Attack dimensions | Capabilities | Risk levels |
|---|---|---|
| Credential theft | npm tokens, GitHub PATs, AWS/GCP/Azure full-chain credentials | 🔴 Extremely serious |
| CI/CD penetration | GitHub Actions OIDC token swapped for npm publish token | 🔴 Extremely serious |
| Docker escape | 3 ways to escape containers through host socket | 🟠 Serious |
| Persistence | 5 mechanisms: shell rc, VS Code extension, Git hooks, systemd/LaunchAgent, GitHub C2 backdoor | 🔴 Extremely serious |
| Data Breach | GitHub API as C2 Channel, 256,000 Dune Topic Naming Combinations | 🟠 Critical |
| Signature forgery | Use stolen OIDC token to obtain Sigstore/Fulcio certificate and sign malicious artifacts | 🟠 Critical |
Five persistence mechanisms
The malware carries five different persistence mechanisms, layer by layer:
- Shell RC Injection — Write payload to
.bashrc/.zshrc, triggered every terminal session - VS Code Extension — Disguise as a VS Code extension to re-execute malicious code
- Git Hooks — Injected into Git hooks, activated every time AI session or git operation
- systemd/macOS LaunchAgent — Install a system-level daemon to ensure survival after reboot
- GitHub Dead-Drop C2 Backdoor — Python daemon polls hourly for RSA-PSS signed commands via the GitHub commit search API
Self-healing and concealment mechanism
The attacker's design of the leakage channel is extremely sophisticated - it does not rely on servers controlled by external attackers at all, and all communications use GitHub's own API:
- Exfiltrated data submitted to a public GitHub repository named after the Dune theme (256,000 combinations)
- GitHub API traffic is indistinguishable from normal developer tools traffic
- B batch sender is leaked in batches with a threshold of 100KB
- Self-cleaning in CI environment: remove workflow run, reset branch, but keep GitHub Actions artifact
Impact on developers and CI/CD
| Scenario | Risk | Recommended Action |
|---|---|---|
| Daily npm install | New versions may contain malicious payloads | Setup npm config set min-release-age=2 |
| CI/CD pipeline | OIDC token can be exchanged for npm publish token | Limit OIDC permission scope |
| Docker environment | Malicious packages can attempt container escape | Using rootless container engines |
| AI programming agent | Attacks may be triggered when automatically installing dependencies | Add security audit steps to the AI agent workflow |
| Multiple Node.js projects | Attacks automatically infect other projects on the same machine | Use isolation environments between projects |
Prevention suggestions
# npm （2 ）
npm config set min-release-age=2
# pnpm allowBuilds
pnpm config set allow-builds="safe-packages-only"
# CI OIDC
# GitHub Actions: id-token: write（）
GitHub、VS Code、Docker、Node.js、Python
Related reading
Internal link guidance
- Want to know how to protect your AI automation pipeline? Watch: How to add quality gates to your AI automation workflow: A practical guide from output to trustworthy results
- Real case: How developers use AI tools to build automated businesses: He Built an AI Automation Stack with Claude + n8n — $4K to $12K/mo in 6 Months
- Safety protection in automated assembly lines: AI Agent drives automated website operations: Build a fully automatic content pipeline in 30 minutes
Monetization angle
How can you make money from this trend?
WayToClawEarn focuses on verified earn playbooks—not just news. Start from these cases.
n8n + OpenAI affiliate site
Automate content and affiliate monetization
Claude + n8n automation agency
Charge monthly for agent workflow builds