According to Infosecurity Magazine, security experts are warning about a major new secret-stealing worm called Shai-Hulud that’s rapidly spreading through the npm ecosystem. The worm first appeared in September when threat actors hijacked developer accounts and compromised 180 packages by month’s end. Now in its “Second Coming” phase, it’s targeting popular projects like Zapier and PostHog and has already infected more than 700 packages with over 100 million downloads. GitHub is removing attacker-created repositories, but the worm is scaling at an alarming rate with 1,000 new repos discovered every 30 minutes. Security firm Wiz warned that given the campaign’s scale and pace, teams should urgently review dependencies and deploy remediation steps.
Why This Is Different
Here’s the thing about supply chain attacks – we’ve seen them before, but this one feels different. The sheer scale is staggering. We’re talking about 100 million downloads potentially affected. And the propagation method is particularly clever – it doesn’t just sit there, it actively looks for other packages maintained by the same developers and creates new malicious versions. Basically, it’s building its own distribution network. What really worries me is that this isn’t just about stealing a few AWS keys. As Mondoo’s analysis shows, this could lead to ransomware footholds and a fundamental loss of trust in the entire npm ecosystem.
The Evasion Tricks
The technical details here are fascinating. Garrett Calpouzos from Sonatype points out that the malware uses an unusual two-file structure to evade detection. The first file checks for and installs a non-standard ‘bun’ JavaScript runtime, then uses that to execute the actual malicious payload. But here’s where it gets really clever – the malicious file is so massive that it apparently confuses AI analysis tools. Both ChatGPT and Gemini struggle to analyze it because it exceeds their context windows. So we’ve reached a point where attackers are literally weaponizing file size against our security tools. That’s… creative, in a terrifying way.
What This Means For Developers
Look, I’ve been covering these supply chain attacks for years, and the pattern is always the same. There’s initial panic, some packages get removed, and then… what? The fundamental problem remains. The npm ecosystem is built on trust, and that trust is being systematically eroded. When even major projects like Zapier and PostHog are getting targeted, nobody is safe. The Wiz research shows this thing can now infect up to 100 npm packages compared to just 20 in the first version. That’s a 5x increase in propagation capability in just a few months.
The Bigger Picture
So where does this leave us? We’re dealing with an attack that’s not just stealing credentials but actively building infrastructure to spread further. The fact that it’s creating thousands of new GitHub repositories every hour means the cleanup effort is like trying to bail out a sinking ship with a teaspoon. And let’s be honest – how many organizations are actually equipped to handle this level of sophistication? The Aikido analysis suggests urgent action, but I’m skeptical that most teams have the resources or expertise to properly audit hundreds of dependencies. This feels like a wake-up call that’s going to keep ringing until something fundamental changes in how we secure our software supply chains.
