Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems

Trend Research's analysis of Shai‑hulud 2.0 describes a sophisticated NPM supply‑chain malware that uses malicious preinstall scripts to install a Bun runtime, spawn a stealth background payload, harvest credentials and cloud secrets (AWS, GCP, Azure), create attacker‑controlled GitHub repositories and Actions workflows for C2 and secret exfiltration, and automatically backdoor and republish maintainers' NPM packages at scale — creating a wormable vector capable of compromising many downstream users.