Full Breakdown
New Wave of Sha1-Hulud Attacks Compromises Thousands of npm Packages
11/24/2025, 11:23:35 PM
Overview of the Sha1-Hulud Campaign
A second wave of attacks, referred to as the Sha1-Hulud campaign, has emerged, targeting the npm registry and compromising over 25,000 repositories. This new supply chain attack, which began between November 21 and 23, 2025, has been linked to multiple security vendors, including Aikido, HelixGuard, Koi Security, Socket, Step Security, and Wiz. The campaign builds on tactics from a previous attack identified in September 2025, which had already compromised around 180 software libraries.
Attack Mechanism and Impact
The Sha1-Hulud malware introduces a variant that executes malicious code during the preinstall phase of npm packages, significantly increasing exposure during build and runtime environments. Attackers have been found to add a preinstall script named "setup_bun.js" to the package.json file, which stealthily installs the Bun runtime and executes a malicious script called "bun_environment.js." This sequence allows the malware to register the infected machine as a self-hosted runner on GitHub, enabling the execution of arbitrary commands.
The malware is designed to exfiltrate sensitive information, including NPM tokens, AWS credentials, and environment variables, by utilizing the TruffleHog tool to scan local machines. If the malware fails to authenticate or establish persistence, it can trigger a destructive function that wipes the victim's home directory, marking a significant escalation from the initial attack.
Scale of Compromise
Wiz researchers reported that the campaign has affected approximately 350 unique users, with 1,000 new repositories being compromised every 30 minutes. The total number of affected repositories has reached over 26,300, with a combined total of 132 million monthly downloads. Specific packages targeted include those from major services like Zapier and Postman, with notable examples being @zapier/zapier-sdk and @ensdomains/ensjs.
Official Statements & Responses
Security experts have urged organizations to take immediate action to mitigate risks associated with the Sha1-Hulud campaign. Recommendations include scanning endpoints for compromised packages, removing infected versions, rotating credentials, and auditing repositories for suspicious files. Koi Security characterized the second wave as significantly more aggressive, emphasizing the shift from data theft to potential data destruction.
Criticism & Opposition
Some experts have expressed concern regarding the rapid evolution of the Sha1-Hulud malware, noting that the attackers have learned from their previous mistakes and adapted their strategies. The ability of the malware to turn victims into active threats by using stolen credentials to compromise additional packages has raised alarms about the broader implications for software supply chain security.
Verbatim Quotes
- “This campaign continues the trend of npm supply-chain compromises referencing Shai-Hulud naming and tradecraft, though it may involve different actors," Wiz said.” — Wiz Researchers
- “However, this wiper-like functionality is triggered only when the following conditions are satisfied - It cannot authenticate to GitHub It cannot create a GitHub repository It cannot fetch a GitHub token It cannot find an npm token "In other words, if Sha1-Hulud is unable to steal credentials, obtain tokens, or secure any exfiltration channel, it defaults to catastrophic data destruction," security researchers Yuval Ronen and Idan Dardikman said.” — Yuval Ronen, Koi Security
- “Victims Become Threats The malware automatically scans both the local computer and connected cloud accounts and uses the TruffleHog tool to “ransack developer machines” for every secret it can find.” — Charlie Eriksen, Aikido Security
What's Next
As the situation develops, security researchers continue to monitor the impact of the Sha1-Hulud campaign. Organizations are advised to remain vigilant and implement recommended security measures to protect against further compromises.
