Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware (Campaign)

On 2025-09-15, malicious versions of multiple popular npm packages were published containing post-install scripts that use TruffleHog to harvest secrets (environment variables, cloud IMDS keys, and repository credentials) and exfiltrate them to attacker-controlled GitHub repositories named "Shai-Hulud" and a webhook. Valid GitHub tokens are validated and abused to: create public dumps, push GitHub Actions that exfiltrate repository secrets, and migrate private organizational repos to public attacker-controlled accounts; the campaign is self-propagating and is linked to earlier GitHub token theft in the s1ngularity campaign.