Security & Threat Intelligence · 27.08.2026, 00:17 UTC
Mini Shai-Hulud npm Attack: Over 2,200 Components Compromised
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | Sonatype ↗ |
| Veröffentlicht | 27.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR A new wave of the Shai-Hulud malicious package campaign emerged on npm, with 2,225 software component versions impacted. The malware executes through a malicious preinstall hook, steals npm, GitHub, cloud, Kubernetes, Vault, CI/CD, and other credentials, then uses stolen publishing access to compromise additional packages. Organizations that installed an affected version should treat the environment as potentially compromised. Remove the malware and any persistence before revoking credentials, then rebuild from known-good components. On August 4, 2026, Shai-Hulud re-emerged in the keyv and cacheable ecosystems on npm, quickly expanding into packages controlled by other maintainers, including packages in the @servicetitan namespace. The affected releases use trusted packages to deliver credential-stealing malware and propagate into additional npm components. The package may be legitimate while the release is not. What Happened? Attackers published malicious versions of legitimate npm packages through a compromised GitHub maintainer account and additional publishing accounts reached using stolen credentials, including accounts with access to packages in the @servicetitan namespace. The affected releases contain a malicious preinstall hook that invokes setup.mjs. Where dependency lifecycle scripts are permitted, the loader downloads a standalone Bun runtime and executes an obfuscated second-stage payload identified as Math_Symbol.js or Math_Init.js. npm 12 blocks unapproved dependency install scripts by default, but the hook can still execute in earlier …