# 600 npm Packages Weaponized in Massive Shai-Hulud Supply Chain Attack
In a coordinated assault spanning just one hour, threat actors injected malicious code into over 600 npm packages, marking the third and most destructive wave of the Shai-Hulud supply chain campaign. The attack demonstrates an alarming evolution in sophistication—with new capabilities to forge legitimate software signatures and exploit long-dormant open-source projects that remain widely trusted by developers worldwide.
## The Threat: Scale and Speed
On May 19, 2026, security researchers at Socket and Endor Labs detected a coordinated deployment of 639 malicious package versions across 323 unique npm modules. The assault unfolded with striking efficiency: the entire operation took approximately one hour to publish, underscoring the attackers' sophistication and access to compromised publishing credentials.
The malicious packages were distributed across multiple ecosystems:
| Component | Details |
|-----------|---------|
| Primary target | @antv ecosystem (charting, visualization) |
| Scope | 639 malicious versions in 1 hour |
| Known packages | echarts-for-react, @antv/g2, @antv/g6, @antv/l7, @antv/g2plot |
| GitHub abuse | 2,700+ rogue repositories created with stolen tokens |
| Monthly impact | Some compromised packages have 10+ million monthly downloads |
Popular packages outside the @antv namespace were also affected, including timeago.js, size-sensor, canvas-nest.js, and jest-canvas-mock—libraries with massive download counts despite years of inactivity.
## Background and Context: A Persistent Campaign
Shai-Hulud is not a new threat. The campaign began in September 2025 and has since evolved across multiple package ecosystems—npm, PyPI, and Composer. Each wave demonstrates refinement in both targeting and payload obfuscation, suggesting either a well-resourced threat actor or a collective effort among multiple groups.
Previous Shai-Hulud Waves:
A critical complication emerged when the Shai-Hulud malware source code was leaked by the TeamPCP threat group on GitHub. This leak has made attribution increasingly difficult and lowered the barrier to entry for additional threat actors seeking to conduct their own supply chain campaigns using proven tools.
## Technical Details: Sophisticated Exfiltration and Obfuscation
The malware payload in this latest campaign is heavily obfuscated and designed to harvest an extensive inventory of secrets from compromised machines:
Targeted Credentials:
Exfiltration Methods:
The attackers employ multiple techniques to transmit stolen data, making detection and takedown efforts significantly more challenging:
1. Session P2P Network – Primary exfiltration channel designed to evade traditional network monitoring
2. GitHub Repositories – When GitHub tokens are available, the malware automatically creates repositories under victims' accounts and uploads stolen data to them; researchers have identified 1,900+ publicly visible rogue repositories with campaign markers, though Aikido estimates the actual number exceeds 2,700
3. Encryption Pipeline – Stolen data is serialized, gzip-compressed, AES-256-GCM-encrypted, and RSA-OAEP-wrapped to prevent network inspection from revealing its contents
## The Supply Chain Vulnerability: Dormant Packages at Scale
A critical vulnerability emerged from the attackers' targeting strategy: they systematically compromised maintainer accounts and publishing tokens for packages that had not received legitimate updates for years—packages that developers still rely on heavily.
Case Study: jest-canvas-mock
Packages in this state represent a perfect storm for attackers: they retain massive distribution networks while operating under minimal security oversight. Maintainers may be unresponsive, security features may not have been implemented, and the absence of recent activity creates a false sense that no one is actively monitoring the package.
## A New Attack Vector: Forging Software Signatures
The May 2026 wave introduced a particularly concerning capability: the ability to generate valid Sigstore provenance attestations by abusing OIDC tokens stolen from compromised CI/CD environments. The malware accomplishes this by:
1. Extracting OIDC tokens from compromised GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, and other build platforms
2. Submitting these tokens to Fulcio and Reko (Sigstore infrastructure)
3. Obtaining cryptographically valid provenance attestations
This means malicious npm packages can now appear legitimately signed and pass standard provenance verification checks—even while containing credential-stealing malware. This attack undermines one of the supply chain's newest security mechanisms.
## Self-Propagation: Lateral Movement Through Ecosystems
The malware includes a self-propagating capability that transforms individual compromises into chain reactions:
This means a single compromised maintainer account can trigger dozens or hundreds of secondary compromises within minutes, spreading the attack across an entire ecosystem.
## Implications for Developers and Organizations
Immediate Risks:
Organizations using affected packages face exposure of sensitive credentials stored in developer environments and CI/CD systems. A single compromised package can grant attackers access to:
Broader Supply Chain Erosion:
This campaign demonstrates that the npm ecosystem's security model—built on trust in maintainer accounts and package integrity—remains fundamentally vulnerable. The introduction of Sigstore signature forgery shows that cryptographic protections can be bypassed when source systems are compromised.
## Recommendations
Immediate Actions:
Structural Improvements:
---
## HackWire Analysis
The Shai-Hulud campaign represents a fundamental shift in how supply chain attacks will operate at scale. This is no longer about compromising individual high-value targets; it's about weaponizing the entire ecosystem's trust infrastructure in parallel.
What makes this wave particularly significant:
The addition of Sigstore signature forgery transforms the attack from "steal credentials" to "compromise the verification system itself." When a package can pass cryptographic integrity checks *and* contain malware, the security model collapses. Organizations cannot defend themselves through signature verification alone if OIDC tokens are stolen. This is roughly equivalent to compromising a certificate authority—the damage compounds across all downstream consumers.
The targeting of dormant packages is equally troubling. The npm ecosystem has 2+ million packages; maintaining security across all of them is impossible. But packages that are downloaded 10 million times monthly while dormant for 3 years represent low-hanging fruit. They're trusted because they're old and widely used. They're vulnerable because no one's watching. This creates an incentive structure that favors attacking the graveyard.
The timing and attribution problem:
With Shai-Hulud's code now public (thanks to the TeamPCP leak), attribution has become nearly impossible. Any moderately capable threat actor can now run a Shai-Hulud campaign. The npm foundation and security community have no way to distinguish between the original operators and copycat groups. This suggests the ecosystem should prepare for *sustained, repeated waves* from multiple sources using the same toolkit.
Practical implications:
For development teams, this means rotating credentials is no longer a reactive measure—it should be routine. Assume your CI/CD environment is compromised as a baseline assumption. For package maintainers, OIDC trusted publishing is now table stakes, not optional. For npm itself, the time has passed for voluntary cooperation; the platform needs mandatory signing and perhaps aggressive takedown of dormant packages that haven't been updated in years.
— HackWire Editorial
---
## Related Coverage