# Shai Hulud Supply-Chain Campaign Compromises 400+ Packages with Signed Malicious Code


A sophisticated supply-chain attack targeting Node.js and Python developers has weaponized cryptographic trust itself, delivering credential-stealing malware through over 400 compromised packages signed with valid provenance attestations. The campaign, attributed to the TeamPCP threat group and dubbed Shai Hulud, has exposed the critical gap between cryptographic verification and actual code integrity.


## The Threat


The latest iteration of the Shai Hulud campaign, escalated on May 11, 2026, compromised hundreds of widely-used developer packages across multiple ecosystems:


  • npm: 160+ compromised packages (Endor Labs), 416+ total artifacts across repositories (Socket)
  • PyPI: Malicious package versions distributed
  • Composer: Additional compromised artifacts detected

    • The attack chain began with TanStack and Mistral AI packages before spreading to other critical projects including Bitwarden CLI, Guardrails AI, UiPath, OpenSearch, and official SAP packages. From a developer's perspective, these packages appeared completely legitimate—they carried valid cryptographic signatures, SLSA Build Level 3 provenance attestations, and authentic GitHub Actions signatures.


    The malware payload targets an extensive array of sensitive credentials:


    | Credential Type | Target Systems |

    |---|---|

    | Authentication Tokens | GitHub Actions OIDC tokens, PATs, npm publish tokens |

    | Cloud Infrastructure | AWS Secrets Manager, IAM credentials, ECS task credentials |

    | Container Orchestration | Kubernetes service account tokens, cluster credentials |

    | Infrastructure as Code | HashiCorp Vault tokens, SSH keys |

    | Development Tools | Claude Code configurations, VS Code tasks, .env files |

    | Blockchain Assets | Cryptocurrency wallet credentials |


    The malware scans more than 100 file paths to extract credentials from cloud providers, cryptocurrency wallets, and messaging applications, then exfiltrates data via the Session P2P encrypted network—a technique that masks command-and-control traffic as legitimate messenger communications.


    ## Background and Context


    The Shai Hulud campaign is not new. It emerged in September 2025 and has evolved through multiple iterations, each time growing more sophisticated and expanding its reach. What makes the current wave particularly alarming is the abuse of legitimate security infrastructure—the very mechanisms designed to prevent exactly these kinds of attacks.


    The attackers exploited three chained vulnerabilities in the TanStack development workflow:


    1. Risky pull_request_target configuration: This GitHub Actions trigger runs with elevated permissions for pull requests from forks, allowing untrusted code to access repository secrets

    2. GitHub Actions cache poisoning: Attackers poisoned the build cache with malicious dependencies, injecting code into subsequent builds

    3. OIDC token theft: The attackers extracted valid OpenID Connect tokens directly from runner memory during the build process


    These stolen OIDC tokens allowed the attackers to impersonate the legitimate TanStack CI/CD pipeline and publish malicious package versions that appeared indistinguishable from legitimate releases.


    ## Technical Details: How the Attack Works


    ### Cryptographic Deception


    The most insidious aspect of this campaign is its exploitation of trust mechanisms. The malicious packages included:


  • Valid SLSA provenance attestations tied to the legitimate TanStack/router release workflow
  • Legitimate GitHub Actions signatures from real CI/CD pipelines
  • Proper cryptographic verification that all automated security tools would pass

    • This created a situation where security scanners, provenance verification tools, and manual code reviews would all confirm the packages as authentic—yet they contained malware.


    ### The Git Commit Trick


    Endor Labs researchers identified a clever technique where attackers pushed malicious commits to a fork, then referenced them via optional dependencies. Even though the commits didn't belong to any active branch, GitHub's shared fork object storage made them accessible—allowing npm to fetch and execute attacker-controlled code during installation.


    ### Persistence Mechanism


    Unlike simple malware that disappears when the package is uninstalled, the Shai Hulud payload achieves persistence by injecting itself into development tool configurations:


  • Writes hooks into Claude Code configuration
  • Modifies VS Code auto-run tasks
  • Establishes footholds that survive package removal

    • An infected developer's entire development environment becomes a persistent attack surface, automatically exfiltrating credentials from every build, deployment, and development activity.


    ### Self-Propagation


    Once a maintainer is compromised, the malware uses their stolen credentials to:


    1. Enumerate all packages maintained by that developer

    2. Modify package tarballs to inject the malicious payload

    3. Republish infected versions with valid signatures

    4. Repeat the cycle with newly compromised maintainers


    This creates an expanding web of compromise where each newly infected developer becomes another vector for spreading the malware to their entire dependency chain.


    ## Implications for Organizations


    ### The Trust Collapse


    This campaign reveals a fundamental vulnerability in modern software supply chains: cryptographic signatures no longer guarantee code integrity. An attacker with valid OIDC tokens can issue signatures that are cryptographically identical to legitimate ones. Traditional security controls—automated scanning, signature verification, provenance attestation—all failed to catch these attacks.


    ### Scope of Exposure


    The attack primarily targets developers, but the blast radius extends far beyond:


  • Development teams with access to AWS, Kubernetes, and vault credentials
  • Organizations deploying applications built with compromised dependencies
  • CI/CD pipelines that execute code from compromised packages
  • Cloud infrastructure accessible through stolen credentials

    • Any organization whose developers installed these packages during the compromise window is potentially affected.


    ### The Credential Extraction Problem


    The malware's ability to extract credentials from 100+ different file paths and environment sources means that a single compromised package can unlock:


  • Production cloud infrastructure
  • Kubernetes clusters running critical services
  • Vault instances protecting encryption keys
  • GitHub repositories containing proprietary code
  • npm registries allowing republication of other packages

    • ## Recommendations


    ### Immediate Actions


    Developers and Teams:

  • Audit CI/CD workflows for pull_request_target usage; prefer pull_request with careful secret handling
  • Rotate all credentials that may have been accessed by development machines during the compromise window
  • Check GitHub Actions audit logs for suspicious token usage
  • Review Claude Code and VS Code task configurations for unauthorized entries
  • Scan development machines for the Session P2P network indicator

    • Security Teams:

  • Identify and revoke any OIDC tokens or PATs issued to compromised CI/CD workflows
  • Monitor npm and PyPI registries for packages published using stolen credentials
  • Implement network detection for Session P2P traffic
  • Cross-reference developer machine access logs against the compromise timeline

    • ### Long-Term Hardening


    Supply Chain Security:

  • Implement hermetic builds that cannot access shared fork storage
  • Require approval workflows for GitHub Actions token generation
  • Use OIDC token scoping to limit CI/CD permissions to specific repositories
  • Deploy code signing without relying on CI/CD OIDC tokens directly in production

    • Credential Management:

  • Eliminate credentials from development machines wherever possible
  • Use role-based access with temporary credentials from managed identity providers
  • Implement aggressive credential rotation policies for development tooling
  • Monitor for unusual credential access patterns

    • Detection and Response:

  • Deploy EDR solutions that can detect Session P2P network traffic
  • Create alerts for mass package republication activity
  • Monitor for successful credential extraction from development environments
  • Establish incident response procedures for compromised CI/CD tokens

    • ---


    ## HackWire Analysis


    The Shai Hulud campaign represents a watershed moment in supply-chain security: attackers have effectively learned to forge not just code signatures but the entire chain of custody. For years, the security industry has preached "verify provenance"—but this attack demonstrates that provenance verification becomes meaningless when the attestation authority itself is compromised.


    What's particularly alarming is the targeting vector. Rather than attacking end users or production systems, these attackers are hunting developer credentials at the source—the moment when developers have legitimate access to the crown jewels of modern infrastructure (AWS keys, Kubernetes tokens, vault credentials, GitHub PATs). A single compromised developer machine becomes a master key to an organization's entire cloud infrastructure.


    The use of Session P2P for exfiltration is a tactical choice that suggests sophisticated operational security. By masking malicious traffic as encrypted messenger communications, the attackers force defenders to choose between blocking legitimate privacy tools or accepting that adversary command-and-control will evade network detection.


    The persistence mechanism—writing to Claude Code hooks and VS Code tasks—reveals that the attackers understand the modern developer toolkit intimately. They're not just distributing malware; they're embedding themselves into the development lifecycle itself. Uninstalling a malicious package isn't enough; you have to forensically examine every configuration file and initialization script.


    For defenders, the critical lesson is this: you cannot trust downstream verification of supply-chain integrity alone. You must implement upstream controls—hermetic builds, OIDC token scoping, credential hygiene at the CI/CD level—before your packages ever reach npm. The era of "verify after publication" has ended.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)