S9008: Shai-Hulud
Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]
Security context for executives and security teams
S9008: Shai-Hulud describes [Shai-Hulud](https://attack.mitre.org/software/S9008) is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, [Shai-Hulud](https://attack.mitre.org/software/S9008) steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled ...
Executive priority
S9008: Shai-Hulud is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S9008: Shai-Hulud by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, SaaS, Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S9008: Shai-Hulud appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Shai-Hulud
Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1027 | Obfuscated Files or Information | Shai-Hulud has utilized double-base64 encoding to store stolen secrets within the Github Action Logs within the victim account.[5][6][7][4] Shai-Hulud has also leveraged three layers of base64 encoding of exfiltrated data for anti-forensic purposes.[3] |
| Enterprise | T1548.003 | Sudo and Sudo CachingSub-technique | Shai-Hulud has attempted to gain root access by leveraging `sudo` and `/etc/sudoers.d`.[3] |
| Enterprise | T1543.002 | Systemd ServiceSub-technique | Shai-Hulud has stopped `systemd-resolved` in order to manipulate DNS and firewalls.[3] |
| Enterprise | T1678 | Delay Execution | Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.[1] |
| Enterprise | T1677 | Poisoned Pipeline Execution | Shai-Hulud has also leveraged GitHub actions from stolen accounts in order to create a malicious Github workflow within `.github/workflows/discussion.yaml`.[5][6][1][3] |
| Enterprise | T1485 | Data Destruction | Shai-Hulud has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder.[1][3] Shai-Hulud has also utilized the `shred` command on Linux devices.[2] |
| Enterprise | T1552.001 | Credentials In FilesSub-technique | Shai-Hulud has gathered sensitive data stored in the Node.JS file `process.env` to include credentials and API keys.[5][3][4] Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include `~/.aws/credentials`, `application_default_credentials.json`, and `azureProfile.json`.[6][1][3][4] Shai-Hulud has also targeted credentials and tokens stored in NPM files `.npmrc` and GitHub config files.[6][1][3][4] |
| Enterprise | T1685 | Disable or Modify Tools | Shai-Hulud has replaced DNS configuration from `/tmp/resolved.conf` in order to gain control of network-level control within CI environments and has flushed iptables rules using `sudo iptables -F OUTPUT` and `sudo iptables -F DOCKER-USER`.[3] |
| Enterprise | T1195.001 | Compromise Software Dependencies and Development ToolsSub-technique | |
| Enterprise | T1105 | Ingress Tool Transfer | Shai-Hulud has downloaded packages from code repositories.[5][7][3][4] Shai-Hulud has also downloaded and executed the secrets-discovery tool TruffleHog to gather sensitive data.[6][7][2][3][4] |
| Enterprise | T1059.004 | Unix ShellSub-technique | Shai-Hulud has utilized Linux shell commands to modify configuration files.[3] |
| Enterprise | T1078.004 | Cloud AccountsSub-technique | |
| Enterprise | T1555.006 | Cloud Secrets Management StoresSub-technique | Shai-Hulud has gathered secrets from AWS Secrets and GCP Secret Manager.[5][6][3] Shai-Hulud has also gathered data from Azure Key Vault.[6][3] |
| Enterprise | T1564.011 | Ignore Process InterruptsSub-technique | Shai-Hulud has suppressed NPM warnings by silently exiting through the use of the NPM success code that has a setting that all errors exit with `code 0`.[3] |
| Enterprise | T1119 | Automated Collection | Shai-Hulud has the ability to automatically collect host data, secrets, system information, and endpoints.[5][6][2] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Shai-Hulud has utilized curl to install Bun over HTTPS.[2] |
| Enterprise | T1593.003 | Code RepositoriesSub-technique | Shai-Hulud has the ability to search open sites and code repositories for compromised credentials.[5][2] Shai-Hulud has discovered packages associated with compromised accounts.[6] Shai-Hulud has also searched code repositories for other compromised repositories that include predefined parameters or markers to include “Second Coming” combined with an 18-character alphanumeric string.[6] |
| Enterprise | T1567.001 | Exfiltration to Code RepositorySub-technique | Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets.[5][6][7] Shai-Hulud has also posted stolen credentials to public GitHub repositories.[1][2][3][4] |
| Enterprise | T1036.009 | Break Process TreesSub-technique | Shai-Hulud has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.[1][3] |
| Enterprise | T1528 | Steal Application Access Token | Shai-Hulud has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.[6][1][7][3] |
| Enterprise | T1098 | Account Manipulation | Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.[5][6][7][2] |
| Enterprise | T1553 | Subvert Trust Controls | Shai-Hulud has suppressed victim NPM warnings using `process[“exit’](0x0);` which results in having all errors exit with code 0.[3] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | Shai-Hulud has masqueraded as a legitimate Bun installer.[1][3] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.[5][1][7] |
| Enterprise | T1546.016 | Installer PackagesSub-technique | Shai-Hulud has inserted a new lifecycle hook to include `postinstall`.[5][1][7][3] Shai-Hulud has also leveraged the NPM lifecycle hook `preinstall`.[6][1][2][3] |
| Enterprise | T1608.001 | Upload MalwareSub-technique | Shai-Hulud has published malicious gzip-compressed tarball (.tgz) following modification of packages within compromised accounts.[5][4] Shai-Hulud has also modified packages within compromised accounts.[6][7] |
| Enterprise | T1567.004 | Exfiltration Over WebhookSub-technique | Shai-Hulud has exfiltrated repository secrets to `webhook[.]site`.[7] |
| Enterprise | T1213.003 | Code RepositoriesSub-technique | Shai-Hulud has downloaded existing packages from code repositories and extracted data stored within them.[5] |
| Enterprise | T1059.001 | PowerShellSub-technique | Shai-Hulud has utilized PowerShell `Invoke-WebRequest` to download and install the malicious payload.[2] |
| Enterprise | T1552.005 | Cloud Instance Metadata APISub-technique | Shai-Hulud has queried the AWS and GCP metadata endpoints for instances and service credentials.[5] |
| Enterprise | T1082 | System Information Discovery | Shai-Hulud has gathered victim system information.[5][3] |
| Enterprise | T1550.001 | Application Access TokenSub-technique | Shai-Hulud has leveraged captured valid NPM tokens to enumerate and update packages on compromised accounts.[5][3][4] Shai-Hulud has also utilized stolen GitHub access tokens to access compromised accounts.[3][4] |
| Enterprise | T1059.007 | JavaScriptSub-technique |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | 972106ec1370… | ||
| 19.1 | 1.0 | Older bundle | 972106ec1370… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Palo Alto Unit 42 Shai-Hulud November 2025
Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.
Open source URL - [2]Microsoft Shai-Hulud December 2025
Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.
Open source URL - [3]Socket Shai-Hulud November 2025
Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.
Open source URL - [4]Socket Shai-Hulud Trufflehog September 2025
Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.
Open source URL - [5]Aikido Shai-Hulud September 2025
Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.
Open source URL - [6]Netskope Shai-Hulud November 2025
Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.
Open source URL - [7]Wiz Shai-Hulud September 2025
Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.
Open source URL - [8]mitre-attackS9008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.