Happy Birthday, Shai-Hulud
Shai-Hulud npm worm anniversary highlights year of supply chain attacks and arrests.
One year after its initial compromise of the @ctrl/tinycolor npm package, the Shai-Hulud worm has caused widespread supply chain security issues. The worm, which harvests credentials and self-propagates, has seen multiple waves and evolved its attack methods, including exploiting OIDC tokens. Two alleged members of the group TeamPCP, which adopted and open-sourced the worm framework, were arrested in Australia.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdStrike?
Get an email when a new story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Shai-Hulud worm demonstrates how a single compromised open-source package can serve as a persistent beachhead for ongoing, evolving supply chain attacks. By harvesting credentials and leveraging OIDC tokens, the worm expanded its reach far beyond the initial @ctrl/tinycolor compromise, illustrating that supply chain threats are not one-time events but long-lived campaigns. The open-sourcing of the worm framework by TeamPCP amplified the threat by lowering the barrier for other attackers to adopt and adapt the tooling. This incident underscores that organizations must treat third-party package dependencies as a critical attack surface requiring continuous scrutiny, not just point-in-time review.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Shai-Hulud
- malware — Sha1-Hulud: The Second Coming
- malware — Mini Shai-Hulud
- url — https://github.com/TeamPCP/Shai-Hulud