Shai-Hulud Malware and FOSSA's Impact Assessment Tool

Last week, reports began to surface about the discovery of Shai-Hulud, a self-replicating worm that's infected several hundred npm packages. Shai-Hulud works by compromising maintainer credentials, injecting malicious postinstall scripts, and stealing secrets like environment variables, cloud tokens, and GitHub access keys.

The fact that Shai-Hulud appears to be the first successful self-propagating npm malware — coupled with the fact that it's already affected numerous popular libraries (like @ctrl/tinycolor and ngx-bootstrap, among others) — has created significant risk to applications and build pipelines globally.

In this blog, we'll provide a quick technical overview of the malware, discuss remediation strategies, and introduce our new Shai-Hulud Impact Assessment Tool, which helps organizations determine whether their projects include compromised libraries and take action if necessary.

Shai-Hulud: Technical Background

The Shai-Hulud malware was first observed around September 15, 2025, when anomalous npm package versions and unusual publishing behavior were flagged. (The worm was named “Shai-Hulud” because stolen data was sent to public GitHub Repos named Shai-Hulud.)

Here's a brief overview of the attack mechanism:

1. After the attacker gains npm maintainer credentials (via phishing or stolen tokens), they publish malicious package versions embedding a bundle.js payload in postinstall scripts.


2. Once installed, the malware harvests secrets using tools like TruffleHog, seeks GitHub/NPM/cloud credentials, exfiltrates data into attacker-controlled GitHub repos (often named "Shai-Hulud"), deploys new GitHub Actions workflows, and sometimes migrates private repos to public ones with a -migration suffix.


3. The worm automatically uses any npm tokens on an infected host to identify other packages from that maintainer, infecting them in turn, causing exponential spread.

Recommended Mitigations

Given the widespread impact to the npm ecosystem, it's highly recommended that organizations prioritize investigating and addressing any Shai-Hulud impact to their applications. You might consider the following mitigations:

• Uninstall compromised versions and clear caches (npm cache clean --force) across dev & CI environments.
• Rotate all credentials: GitHub tokens, npm tokens, cloud provider keys.
• Audit GitHub and repos: Look for repos named “Shai-Hulud”, branches or workflows named shai-hulud-workflow.yml, and private repos made public with the -migration suffix.
• Enforce strong account security: Enable MFA/2FA, use least-privilege tokens, restrict npm publish rights.
• Use supply chain security and monitoring tools, such as dependency scanners, SCA tools like FOSSA, and SBOMs.

Using FOSSA’s Shai-Hulud Impact Assessment Tool

To help organizations understand and mitigate their potential Shai-Hulud exposure, FOSSA has published a free and open source Impact Assessment Tool.

The Impact Assessment Tool contains a curated list of compromised npm packages and versions known to be affected by Shai-Hulud. Developers can run it via FOSSA's CLI or integrate it into CI/CD to scan their project's dependency tree (including transitive dependencies) and flag affected versions. The README provides setup instructions and guidance on interpreting results.

Shai-Hulud represents one of the most serious supply chain threats in the npm ecosystem: self-propagating, stealthy, and with wide impact. Immediate action — cleaning, rotating credentials, auditing — is essential.

For more information on our Impact Assessment Tool, please feel free to contact our team: customer-success@fossa.com. Or, to get started with FOSSA, you can create a free account by visiting our website.