Poisoned Pipeline

Poisoned Pipeline / Incidents / AS48

AS48 · 2025-09

Shai-Hulud first wave (@ctrl/tinycolor)

npmGitHub ActionsGit / GitHubAI coding agentsDeveloper workstation

In September 2025 a malicious version of @ctrl/tinycolor (then ~2M weekly
downloads) started the first known self-propagating worm on npm. Socket’s
one-year recap is the primary timeline: bundle.js ran TruffleHog against
the host, exfiltrated npm/GitHub/cloud secrets to a webhook and to a
public GitHub repo named Shai-Hulud on the victim’s account, planted a
GitHub Actions workflow, then used stolen npm tokens to infect other
packages the maintainer owned. It reached CrowdStrike’s npm namespace
within a day. Hundreds of packages before rollback. Later Mini Shai-Hulud
/ ChainDrop / TanStack waves reused the pattern (AS16, AS28).

Mapped techniques

supply-chain npm worm

T0121 · Resource Development · Compromised legitimate artifact

@ctrl/tinycolor under its real name.

T0109 · Resource Development · Publish malicious artifact

Stolen npm tokens republished the worm into other maintainer packages.

T0140 · Credential Access · Harvest tokens from environment variables

TruffleHog sweep of npm, GitHub, and cloud keys.

T0168 · Exfiltration · Exfiltration to code repositories

Public GitHub repo named Shai-Hulud created on the victim account.

T0166 · Execution · Trigger pipeline execution

Planted GitHub Actions workflow for persistence.

T0169 · Lateral Movement · Push implants across repositories

Self-propagation into every package the stolen token could publish.

Sources