Malware Campaign Targets Software Supply Chains
A malware campaign dubbed “Shai-Hulud” is spreading through the software pipelines used by developers to build and distribute code, raising concerns about the reliance on automated systems with minimal human oversight.
Researchers have linked the Shai-Hulud malware campaign to approximately 320 package entries across Node Package Manager (NPM) and PyPI, two major online repositories used by developers to download and share JavaScript and Python software packages. These affected packages collectively account for over 518 million monthly downloads.
“Shai-Hulud is significant because it exposes a problem we cannot fully patch away: modern software is built by running other people’s code,” said Jeff Williams, CTO of the California-based security firm Contrast Security. “Developers do not merely ‘download’ libraries. They install them, build with them, test with them, deploy with them, and eventually execute them. And if you run a malicious library, it can do almost anything you can do.”
Williams added that advances in artificial intelligence complicate the threat, comparing Shai-Hulud to making a computer a double-agent.
“The scary part is the leverage. If an attacker compromises one obscure package, they do not just get that package,” Williams said. “They get a path into every downstream project that trusts it. Then they can steal more tokens, publish more poisoned packages, and repeat the cycle. The software supply chain is not a chain anymore—it’s a propagation network.”
Recent Incidents and Impact
Earlier this month, Microsoft Threat Intelligence disclosed that attackers inserted malicious code into a Mistral AI software package distributed through PyPI. The malware downloaded an additional file designed to resemble Hugging Face’s widely used Transformers library to blend into machine-learning development environments. Mistral later stated that an affected developer device was involved but that there was “no indication that Mistral infrastructure was compromised.”
Two days later, OpenAI confirmed that malware tied to the same campaign infected two employee devices, giving attackers access to a limited number of internal code repositories. The company found no evidence that customer data, production systems, or intellectual property were compromised.
Named after the giant sandworms in Frank Herbert’s “Dune,” researchers traced earlier versions of the malware back to September 2023 and cybercriminals known as TeamPCP. However, the campaign gained wider attention after a major May 11 attack targeting TanStack, a widely used open-source JavaScript framework used in web and cloud applications.
Growing Threat to Software Supply Chains
Shai-Hulud is part of a growing trend of supply-chain attacks where hackers compromise trusted software tools or services used by other companies. Instead of directly targeting victims, attackers use these trusted systems to spread malicious code or gain access to developer environments.
Researchers say the attacks poison shared build caches, causing future software releases to quietly incorporate the malicious code. To a developer downloading the packages, everything appears normal because the software comes from trusted sources, carries valid signatures, and passes security checks. This is what makes the attack so concerning.
On Sunday, cybersecurity firm OX Security reported that new malicious packages mimicking the original malware were already stealing cloud and crypto wallet credentials, SSH keys, and environment variables. Some variants also attempted to turn infected machines into DDoS botnets.
“One incriminating evidence that this is a different actor from TeamPCP is that the Shai-Hulud malware code is an almost exact copy of the leaked source code, with no obfuscation techniques, which make the final version visually different from the original,” OX Security wrote. “In our breakdown, we show the side by side comparison of the chalk-template Shai-Hulud version with the original source code leak, showing that they are the same.”
Broader Implications
The emergence of Shai-Hulud coincides with the increasing reliance of modern software developers on automated platforms like GitHub Actions. Simultaneously, supply-chain attacks targeting open-source infrastructure have become more common as attackers focus on developer tooling and automated publishing systems rather than end-user systems directly.
“[Shai-Hulud] is a reminder that [systems, applications, and products] attack surface now extends well beyond traditional application layers and into the open-source packages that power modern development and deployment workflows,” said Joris Van De Vis, Director of Security Research at the Netherlands-based cybersecurity firm SecurityBridge.
On Tuesday, GitHub announced it was investigating unauthorized access to its internal repositories after TeamPCP claimed responsibility for stealing roughly 4,000 private repos and offering the data for sale on a cybercrime forum for at least $50,000.
According to Van De Vis, Shai-Hulud also demonstrates how attacks targeting trusted software automation can quickly spread from developer tools into enterprise systems that companies rely on for critical operations.
“When trusted npm dependencies can be weaponized to steal credentials from [Cloud Application Programming] and [Multi-Target Application] environments, the risk is no longer just a developer laptop issue, it becomes a direct path toward productive SAP systems, which is why organizations need tighter dependency controls, exact version pinning, and stronger publishing safeguards,” Van De Vis said.
Leave a Reply