The latest Sha1 Hulud supply chain attack has compromised more than 800 npm packages and tens of thousands of GitHub repositories. The campaign, labeled by its operators as “The Second Coming,” reached major dependencies used across AsyncAPI, Postman, PostHog, Zapier, and ENS. The attackers used the Bun runtime to evade normal detection paths and deployed a destructive fallback that wipes user data when exfiltration fails. Security teams are treating this wave as significantly stronger, faster, and more aggressive than earlier variants.
Relevant Source (Koi Security): Live Updates: Sha1-Hulud, The Second Coming – Hundreds of NPM Packages Compromised
Koi Security’s live incident report details the Sha1-Hulud “Second Coming” wave, confirming 800+ trojanized npm packages, tens of thousands of impacted GitHub repos, and the destructive home-directory wiping fallback.
Quick Facts
- Over 800 npm packages and thousands of GitHub repos compromised.
- Impacted ecosystems include AsyncAPI, Postman, ENS, Zapier, and PostHog.
- Malware executed using Bun runtime to bypass common Node.js defenses.
- Attack includes a data wiping fail-safe when tokens cannot be stolen.
- More than 26,000 malicious GitHub repos created to store stolen secrets.
- Attack likely timed before npm revokes classic tokens on December 9, 2025.
Sha1 Hulud Variant Overview
Sha1 Hulud is an open-source supply chain malware family designed to steal credentials from infected environments. This new variant spreads through poisoned npm packages and GitHub repos tied to widely used dependencies. Attackers run their payload using the Bun runtime, avoiding many Node.js based scanners.
- Executes a malicious environment through setup_bun.js and bun_environment.js.
- Uses TruffleHog to harvest tokens, API keys, and secrets.
- Creates random GitHub repositories labeled with “Sha1 Hulud: The Second Coming.”
This version gained attention because it triggers a wiper routine when exfiltration fails. That behavior raises the stakes since developers face complete directory loss even if secrets remain safe.
Relevant Source (Aikido Security): Shai Hulud Launches Second Supply-Chain Attack: Zapier, ENS, AsyncAPI, PostHog, Postman Compromised
Aikido’s technical write-up breaks down how the latest Sha1-Hulud variant uses setup_bun.js, bun_environment.js, TruffleHog, random GitHub repos, and a wiper routine.
Relevant Source (Wiz): Shai-Hulud 2.0 Supply Chain Attack: 25K+ npm Repos Exposed
Wiz’s research blog analyzes the ongoing Shai-Hulud npm supply chain campaign, detailing Bun-based preinstall execution, malicious payload files, and large scale GitHub exfiltration.
Growing Risk To Developers
This incident hits core tooling used in development workflows. Compromised packages impact analytics platforms, API tooling, automation frameworks, and event driven architecture utilities. Many teams depend on these libraries daily, which broadens the exposure surface quickly.
- High volume of npm downloads raises the blast radius.
- Bun based execution allows stealthy deployment.
- Wiper functionality creates permanent data loss.
- Timing suggests a rush to steal legacy tokens before revocation.
- Infected repos can continue spreading compromised code across CI pipelines.
The destructive capability sets this apart from typical credential stealers. Attackers now inflict real operational damage even when they cannot profit from a breach.
Relevant Source (CISA): Widespread Supply Chain Compromise Impacting npm Ecosystem
CISA’s alert describes large scale npm supply chain compromises impacting widely used developer tooling and shows how routine workflows can become high risk quickly.
Relevant Source (AWS Security Blog): Defending Against Supply Chain Attacks Like Chalk/Debug and the Shai-Hulud Worm
AWS outlines how Shai-Hulud and similar npm attacks threaten CI/CD pipelines and developer environments, reinforcing the operational risk to everyday development teams.
Immediate Defensive Actions
Teams need to perform a full dependency audit and rotate credentials that may have touched affected packages or repos. Detection depends on spotting the malicious setup_bun.js or bun_environment.js files, or identifying outbound activity tied to random GitHub repos.
Steps to take:
- Audit npm packages for suspicious Bun related files.
- Rotate GitHub, npm, and CI tokens immediately.
- Search for GitHub repos with descriptions matching the campaign.
- Inspect logs for unauthorized TruffleHog activity.
- Purge infected environments and reinstall clean dependencies.
Organizations that automate this work will reduce recovery time and limit the spread.
Relevant Source (AWS Security Blog): Defending Against Supply Chain Attacks Like Chalk/Debug And The Shai-Hulud Worm
AWS outlines concrete response steps for Shai-Hulud style npm incidents, including dependency audits, secret rotation, and CI pipeline checks that align with these defensive actions.
Relevant Source (Kudelski Security): Supply Chain Attack Targeting Several NPM Packages To Harvest Credentials
Kudelski’s advisory details how to respond to npm malware by rotating tokens, inspecting install scripts, monitoring publish events, and auditing logs for credential theft.
The Big Picture
The campaign demonstrates how quickly supply chain threats adapt when detection methods become predictable. Attackers rely on less common runtimes and decentralized publishing ecosystems to slip past scanners that rely on static rules. The move toward random repository creation shows a shift away from hardcoded behavior patterns, which complicates traditional threat intelligence workflows.
The destructive fallback also signals a mindset change. Instead of relying only on theft and persistence, threat actors now punish environments they cannot exploit. That creates higher urgency for rotating credentials, patching CI pipelines, and reducing the trust placed in third party dependencies.
Relevant Source (Sonatype): Ongoing npm Software Supply Chain Attack Exposes New Risks
Sonatype’s research outlines how recent npm worm campaigns expose structural weaknesses in package ecosystems and show attackers adapting tactics to bypass defenses.
Relevant Source (Veracode): Software Supply Chain Attacks In 2025
Veracode provides a broader view of 2025 supply chain attacks, highlighting evolving techniques, dependency risk, and the need for stronger controls across CI/CD and third party code.
Staying Ahead Of Supply Chain Threats
This wave of Sha1 Hulud highlights the weakness of relying on default controls in open-source development environments. Security teams that adopt continuous dependency auditing, secret scanning, and token rotation practices will stand a better chance of containing similar attacks. The situation calls for consistent hygiene across CI pipelines rather than quick fixes after an incident.
Key Questions
How many packages were compromised?
More than 800 npm packages and tens of thousands of GitHub repositories.
Which major ecosystems were affected?
AsyncAPI, Postman, PostHog, Zapier, and ENS were among the most significant.
Why is the Bun runtime involved?
Bun allows the malware to run outside typical Node.js paths, avoiding detection.
Does the malware delete data?
Yes. If it fails to steal credentials or establish persistence, it wipes the user’s home directory.
What should organizations do first?
Audit dependencies for known indicators and rotate all GitHub, npm, and CI tokens.
How JENI Helps Strengthen Your Security Posture
JENI delivers system insights that support stronger defensive habits across development and production environments. The platform improves visibility into software behavior, resource usage, and configuration drift in ways that help teams spot unusual activity sooner. It gives organizations a cleaner, more predictable operating baseline that reduces the risk of unnoticed compromise.
Key Ways JENI Supports Stability
- Identifies irregular system processes that can signal hidden payload execution.
- Highlights configuration changes that often accompany malicious supply chain activity.
- Improves machine performance so threat indicators stand out instead of hiding in noise.
JENI aligns well with the challenges raised by the Sha1 Hulud incident because stable systems make anomalies easier to detect. Cleaner runtime environments reduce opportunities for stealthy loaders and unusual runtimes to blend in. Organizations gain a clearer picture of what normal looks like, which raises the chance of catching unexpected behavior early. Stronger visibility and better consistency across machines help teams stay resilient when supply chain attacks evolve quickly.
