Massive “Shai-Halud” Supply Chain Attack Compromised 477 NPM Packages

A large-scale supply chain attack dubbed “Shai-Halud” that infiltrated the JavaScript ecosystem via the npm registry. 

In total, 477 packages, including packages from CrowdStrike, were found to contain stealthy backdoors and trojanized modules designed to siphon credentials, exfiltrate source code, and enable remote code execution (RCE) on developer machines.

Key Takeaways
1. Obfuscated backdoors hit 477 npm packages via minor version updates.
2. Payload harvested and exfiltrated credentials to a C2 server.
3. Fix by pinning versions, supply-chain scanning, checksum checks, and rotating secrets.

Shai-Halud Supply Chain Attack

The adversary’s campaign began in early August 2025, when compromised maintainer accounts were used to publish malicious updates under minor version bumps (e.g., from 1.2.3 to 1.2.4). 

Each update injected a small, obfuscated payload within the module entry file (typically index.js). This loader reached out to a command-and-control (C2) server to fetch a second-stage payload. 

Socket reports that the payload searched project directories for .env files, SSH private keys (id_rsa), and Git credentials stored in .git/config, then transmitted them in encrypted form back to the attacker’s infrastructure.

Packages compromised

Shai-Halud’s use of version-range hijacking allowed attackers to maintain persistence: downstream projects specifying dependencies with loose semver ranges (e.g., “^1.2.0”) automatically pulled in the trojanized release. 

Many high-profile libraries, ranging from development tools and CLI utilities to UI component frameworks, were affected, amplifying the blast radius. Detection strategies include:

Integrate tools like npm audit, Snyk, or OWASP Dependency-Check into CI pipelines to flag anomalous version releases.

Validate package integrity against known good SHA-256 hashes via npm ci –prefer-offline –hash-checksums. Employ runtime monitoring (e.g., Sysmon on Windows, auditd on Linux) to detect unexpected network calls or use of eval().

Mitigations

• Lock Dependency Versions: Pin to specific package versions and avoid wide semver ranges.
• Rotate Secrets: Revoke and regenerate any exposed API tokens, SSH keys, and environment variables.
• Audit Your Dependencies: Run npm ls –prod –depth=0 to see direct dependencies and cross-check against advisories.

As open-source ecosystems remain a prime target, securing the software supply chain through rigorous validation and continuous monitoring is more critical than ever.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post Massive “Shai-Halud” Supply Chain Attack Compromised 477 NPM Packages appeared first on Cyber Security News.