Poisoned Pipeline / Incidents / AS49
Sha1-Hulud: The Second Coming
npmGitHub ActionsGit / GitHubLinux distro / packagesWindows softwareDeveloper workstation
Late November 2025 a second Shai-Hulud wave labeled itself in exfil
repos as "Sha1-Hulud: The Second Coming" (Socket). Execution moved to
preinstall, widening blast radius on developer machines and CI. New
payloads setup_bun.js and bun_environment.js. A destructive fallback
could wipe the user’s home directory. Hundreds of packages again, plus
tens of thousands of attacker-created GitHub repositories. StepSecurity
later noted detection inside CNCF Backstage.
Mapped techniques
- T0151 Installation scripts
- T0109 Publish malicious artifact
- T0168 Exfiltration to code repositories
- T0169 Push implants across repositories
supply-chain npm preinstall worm
Preinstall widened the set of machines that ran the worm.
Hundreds of packages; Bun-based second stage.
Tens of thousands of attacker-created GitHub exfil repos.
Same stolen-token republish loop as the September wave.
Sources
- https://socket.dev/blog/happy-birthday-shai-hulud
- https://www.stepsecurity.io/blog/state-of-open-source-supply-chain-attacks
- https://safedep.io/malicious-pytorch-lightning-pypi-compromise
- https://safedep.io/shai-hulud-second-coming-supply-chain-attack
- https://socket.dev/blog/lightning-pypi-package-compromised
- https://socket.dev/blog/shai-hulud-strikes-again-v2
- https://www.wiz.io/blog/sitf-sdlc-threat-framework
- https://unit42.paloaltonetworks.com/npm-supply-chain-attack/
- https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
- https://docs.zapier.com/integrations/build-cli/inc-547