--- title: "Shai-Hulud Malware and FOSSA's Impact Assessment Tool" description: "Learn why the Shai-Hulud malware is a significant threat to the npm ecosystem, and see how FOSSA's Impact Assessment Tool can help mitigate the risk." canonical_url: "https://fossa.com/blog/shai-hulud-malware-fossa-impact-assessment-tool/" markdown_url: "https://fossa.com/blog/shai-hulud-malware-fossa-impact-assessment-tool.md" content_type: "blog" language: "en" date_published: "2025-09-23" date_modified: "2025-09-23" author: "Andy Drukarev" organization: "FOSSA" --- # Shai-Hulud Malware and FOSSA's Impact Assessment Tool > Learn why the Shai-Hulud malware is a significant threat to the npm ecosystem, and see how FOSSA's Impact Assessment Tool can help mitigate the risk. Last week, reports began to surface about the discovery of Shai-Hulud, a self-replicating worm that's infected several hundred npm packages. Shai-Hulud works by compromising maintainer credentials, injecting malicious `postinstall` scripts, and stealing secrets like environment variables, cloud tokens, and GitHub access keys. The fact that Shai-Hulud appears to be the [first successful self-propagating npm malware](https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack) — coupled with the fact that it's already [affected numerous popular libraries](https://www.securityweek.com/shai-hulud-supply-chain-attack-worm-used-to-steal-secrets-180-npm-packages-hit/) (like @ctrl/tinycolor and ngx-bootstrap, among others) — has created significant risk to applications and build pipelines globally. In this blog, we'll provide a quick technical overview of the malware, discuss remediation strategies, and introduce our new Shai-Hulud Impact Assessment Tool, which helps organizations determine whether their projects include compromised libraries and take action if necessary. ## Shai-Hulud: Technical Background The Shai-Hulud malware was [first observed](https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages) around September 15, 2025, when anomalous npm package versions and unusual publishing behavior were flagged. (The worm was named “Shai-Hulud” because stolen data was sent to public GitHub Repos named Shai-Hulud.) Here's a brief overview of the [attack mechanism](https://arcticwolf.com/resources/blog-uk/wormable-malware-cause-supply-chain-compromise-of-npm-code-packages/):
  1. After the attacker gains npm maintainer credentials (via phishing or stolen tokens), they publish malicious package versions embedding a `bundle.js` payload in `postinstall` scripts.

  2. Once installed, the malware harvests secrets using tools like TruffleHog, seeks GitHub/NPM/cloud credentials, exfiltrates data into attacker-controlled GitHub repos (often named "Shai-Hulud"), deploys new GitHub Actions workflows, and sometimes migrates private repos to public ones with a `-migration` suffix.

  3. The worm automatically uses any npm tokens on an infected host to identify other packages from that maintainer, infecting them in turn, causing exponential spread.
## Recommended Mitigations Given the widespread impact to the npm ecosystem, it's highly recommended that organizations prioritize investigating and addressing any Shai-Hulud impact to their applications. You might consider the following [mitigations](https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2025-019): * **Uninstall compromised versions** and clear caches (`npm cache clean --force`) across dev & CI environments. * **Rotate all credentials**: GitHub tokens, npm tokens, cloud provider keys. * **Audit GitHub and repos**: Look for repos named “Shai-Hulud”, branches or workflows named `shai-hulud-workflow.yml`, and private repos made public with the `-migration` suffix. * **Enforce strong account security**: Enable MFA/2FA, use least-privilege tokens, restrict npm publish rights. * **Use supply chain security and monitoring tools**, such as dependency scanners, SCA tools like FOSSA, and [SBOMs](https://fossa.com/learn/sboms.md). ## Using FOSSA’s Shai-Hulud Impact Assessment Tool To help organizations understand and mitigate their potential Shai-Hulud exposure, FOSSA has published a free and open source [Impact Assessment Tool](https://github.com/fossas/fossa-malware-impacted-packages). The Impact Assessment Tool contains a curated list of compromised npm packages and versions known to be affected by Shai-Hulud. Developers can run it via FOSSA's CLI or integrate it into CI/CD to scan their project's dependency tree (including transitive dependencies) and flag affected versions. The [README](https://github.com/fossas/fossa-malware-impacted-packages/blob/master/README.md) provides setup instructions and guidance on interpreting results. Shai-Hulud represents one of the most serious supply chain threats in the npm ecosystem: self-propagating, stealthy, and with wide impact. Immediate action — cleaning, rotating credentials, auditing — is essential. For more information on our Impact Assessment Tool, please feel free to contact our team: [customer-success@fossa.com](mailto:customer-success@fossa.com). Or, to get started with FOSSA, you can [create a free account](https://app.fossa.com/auth/register) by visiting our website. ## Source Canonical page: https://fossa.com/blog/shai-hulud-malware-fossa-impact-assessment-tool/