Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
- Sarah Gooding
This week marks one year since an attacker pushed a malicious version of @ctrl/tinycolor to npm, kicking off the worst year for npm security on record. At the time, the package was downloaded more than two million times a week. Within a day the same code was spreading on its own across dozens of packages, and then into CrowdStrike's npm namespace. It was the first known self-propagating worm in the npm ecosystem, and it has not really stopped since.
The tinycolor compromise put software supply chain security on everyone's radar in a way it had not been before. Teams that had never given much thought to what they were installing from npm suddenly started paying attention.
The worm harvested credentials and republished itself
The payload was a bundle.js
file that ran TruffleHog, a legitimate secret scanner, to sweep the host for npm tokens, GitHub credentials, and cloud keys. It exfiltrated what it found to a hardcoded webhook and to a public GitHub repository it created on the victim's own account, named Shai-Hulud after the sandworms in Dune. It planted a GitHub Actions workflow for persistence. Then it used the stolen npm tokens to inject itself into other packages the maintainer owned and republish them. By the time npm rolled back the bad versions the worm had seeded, researchers were counting compromised packages in the hundreds.
The worm came back bigger in November
In late November 2025 a second wave arrived, self-described in its exfiltration repositories as "Sha1-Hulud: The Second Coming." It moved execution to the pre-install step, which widened the blast radius across developer machines and CI pipelines, and it shipped new payloads (setup_bun.js
and bun_environment.js
). It also added a more destructive fallback that could attempt to wipe a user's home directory. Counts ran into the hundreds of packages again, alongside tens of thousands of attacker-created GitHub repositories.
The worm exposed long-standing weak spots in how npm and GitHub handled trust: token security, install script execution, and how packages get published. Those were problems maintainers had raised for years, and many of the security improvements across the ecosystem today trace back to the pressure it created.
New waves kept coming through 2026
New waves arrived in April 2026 ("The Third Coming") and again at the end of that month ("Mini Shai-Hulud"). In May, TeamPCP published the worm's source code on GitHub, which removed the last barrier to entry, and ran a contest offering $1,000 in Monero to whoever compromised the most-downloaded packages, scored by weekly and monthly download counts.
It was a comically small payout for the kind of access a supply chain compromise burns. The contest worked mostly as a recruitment stunt for lower-tier actors, but also landed as a taunt, after months of hammering open source projects and plundering credentials through insecure CI pipelines and publishing workflows.
One Mini Shai-Hulud burst in May pushed more than 400 malicious versions across 172 packages in about five hours, hitting TanStack, Mistral AI, UiPath, and OpenSearch, this time with no stolen credential at all, by hijacking short-lived OIDC tokens from CI. Another wave in early August hit more than 400 npm packages. By mid-2026, multiple operators were running Shai-Hulud style campaigns off the same open source code.
Police arrested two alleged TeamPCP members in August
On August 26, 2026, the Australian Federal Police, working with the FBI and Western Australia Police, arrested two men in Western Australia, aged 21 and 23, and charged them over their alleged roles in TeamPCP. Brian Krebs reported that the 21-year-old allegedly led the group until March 2026, when he says he handed it off.
The AFP estimated the group enabled the theft of more than 500,000 credentials and at least 300GB of data, with remediation costs in the hundreds of millions of dollars across more than a thousand organizations. Google has since said it had an undercover analyst inside TeamPCP for much of the group's run, which let it get stolen credentials revoked before the group could use them.
The original Shai-Hulud authors are still unknown
Much of the arrest coverage conflated TeamPCP with the worm's original authors. TeamPCP adopted the Shai-Hulud name for its 2026 waves and open-sourced a worm framework in May, wringing more leverage out of the technique than any operator before it, even with a mole in its ranks. The original September 2025 attack was never definitively attributed to TeamPCP, and neither was the November 2025 follow-up.
With the code now public and widely copied, attribution for anything carrying the Shai-Hulud name only gets harder. The people in custody are alleged operators of the later waves.
For everyone who maintains or depends on npm packages, this was a long year. It started on a September night with a warning to stop installing tinycolor, and it kept going: token rotations, lockfile audits, and the same incident response drill every time another wave landed. TeamPCP named one of its waves "Here We Go Again," which aptly captured the mood on the receiving end.
The code has been public since May, forked and copied and handed between people who never wrote a line of it, and it has stopped depending on any of them. A year after the first compromise, Shai-Hulud belongs to no one and everyone with a GitHub account.