On May 11, 2026, a new wave of Shai-Hulud activity was identified, affecting the npm and PyPI ecosystems through an advanced supply chain worm with separate JavaScript and Python execution paths. The campaign represents a serious compromise of software development and release workflows. According to public reporting, more than 170 packages were affected. The impacted packages include backdoored TanStack components, as well as packages associated with OpenSearch, Mistral AI, Guardrails AI, UiPath, Squawk, and other projects.
The main objective remains aligned with earlier Shai-Hulud activity: stealing credentials from developer systems and CI/CD execution environments, and then using those credentials to compromise additional packages, repositories, and infrastructure. In this wave, the scale, release path, and execution model have changed. The malware is built to run inside build systems, abuse npm lifecycle scripts, install or invoke the Bun runtime, steal credentials related to npm, GitHub, cloud platforms, Kubernetes, Vault, and CI/CD, and use legitimate publishing channels to release newly compromised packages.
One of the most concerning elements of this wave is the abuse of legitimate release pipelines. Malicious packages could be published through standard automation, making them more difficult for developers, security products, and automated workflows to recognize as suspicious.
Cynet helps organizations reduce exposure to Mini Shai-Hulud and related software supply chain attacks on endpoints where Cynet is deployed. It provides layered visibility, detection, prevention, and response capabilities for suspicious activity linked to compromised dependencies and supply chain threats.
Cynet Research and CyOps teams are actively tracking and investigating Mini Shai-Hulud activity. Their work includes researching emerging indicators and attack behaviors, as well as hunting for suspicious activity across customer environments.
New Significant Risk: AI-Driven and Automated Development Workflows
Mini Shai-Hulud underscores a growing risk in AI-driven and automated development workflows. Coding agents, build systems, and automated dependency management tools can install, update, or recommend packages with limited human review. In such environments, a compromised dependency can be introduced into a project, executed automatically, and given access to sensitive tokens, configuration files, or CI/CD credentials.
The issue is not limited to the malware itself. A major concern is the speed at which modern development workflows can introduce it. AI coding agents and automated build systems may install or update packages before the associated risk is reviewed by a person. In that scenario, a compromised dependency can execute quickly, access sensitive credentials, and potentially spread through existing development and release workflows.
Cynet Detection: AI-Assisted Dependency Installation
During one of the Shai-Hulud supply chain attack waves, Cynet observed activity demonstrating how AI-assisted development environments can become part of the exposure path. The observed process chain involved a Cursor helper plugin launching Node.js and npm to install a GitHub-hosted package dependency that was flagged in the context of Shai-Hulud-related activity:
Cursor Helper (Plugin) → /usr/bin/env node → npm install github:asyncapi/cli#2efa4dff59bc3d3cecdf897ccf178f99b115d63d
- Parent process: Cursor Helper (Plugin)
- Runtime launched: /usr/bin/env node
- Package manager action: npm install
- GitHub dependency: github:asyncapi/cli
- Pinned commit: 2efa4dff59bc3d3cecdf897ccf178f99b115d63d
This activity is notable because it shows how modern developer tools can trigger dependency installation directly from GitHub, including from pinned commits, while giving the user limited visibility or opportunity for review. In the context of a supply chain attack, this workflow can allow a compromised or suspicious dependency to be introduced and executed rapidly inside a developer environment.
Such activity should be treated as a high-signal indicator of suspicious behavior and investigated in context. Particular attention should be paid to follow-on script execution, Bun-related activity, credential access, and package installation artifacts.
Technical Details
The supply chain infection begins when a compromised npm or PyPI package is installed or loaded on a developer system, build system, or CI/CD runner. In npm projects, malicious code can execute automatically during dependency installation through package lifecycle scripts or malicious package content. In PyPI projects, malicious Python code may run when the package is imported or loaded.
The campaign includes two primary technical paths: a JavaScript/npm path and a Python/PyPI path. Both are focused on credential theft and exfiltration, but they differ in execution method, platform support, payload structure, and follow-on capabilities.
JavaScript/npm Execution Path
The JavaScript payload is designed to run on Windows, Linux, and macOS systems. It includes a malicious JSON configuration file that launches setup.mjs. The setup script identifies the operating system and installs or invokes the Bun runtime, which is required for later-stage execution. After Bun becomes available, the loader executes router_init.js, which contains the main obfuscated malware payload. Before running its core functionality, the malware performs several sanity checks. It creates an operating-system-specific lock file in a temporary directory to prevent repeated execution. It also checks locale and time zone settings to avoid russian-language environments and determines whether it is running inside a CI pipeline or on a personal system.
The payload is designed to steal secrets through regular expression matching and direct collection from local and cloud-based sources. It searches for npm tokens, GitHub access tokens, GitHub Actions and session tokens, Kubernetes JWTs, AWS access keys and secret keys, AWS session tokens, Azure keys and secrets, Slack tokens, Vault tokens, and generic secrets identified through keywords such as password, pass, token, and key.
In addition to pattern matching, the malware directly targets secret stores and cloud sources.
It attempts to collect GitHub Actions repository secrets, GitHub runner in-memory secrets from Runner.Worker, AWS Secrets Manager values, AWS SSM Parameter Store parameters, AWS STS identity and account metadata, Kubernetes Secrets across accessible namespaces, and HashiCorp Vault KV secrets from mounted and common paths such as secret, kv, cubbyhole, and secret-v2.
The malware also scans local files for credentials and sensitive configuration data. Targeted files and sources include AWS, Azure, GCP, Kubernetes, and Terraform credentials; .npmrc, .pypirc, Git credentials, .netrc, Docker configurations, SSH keys and configurations, environment files, database configuration files, AI and developer-tool configurations such as Claude and MCP settings, VPN client configurations, application session stores, shell history, database history, container secrets, and cryptocurrency wallet files.
The JavaScript variant also contains broader supply chain functionality. It targets npm package tokens that can be used to modify and republish packages, as well as GitHub tokens that can be used to create repositories, abuse workflows, and alter branches. As a result, the JavaScript path has stronger worm-like behavior and can extend the compromise beyond the initially infected system.
Some reported JavaScript activity also includes persistence through a deadman-switch mechanism. The malware installs a background monitoring component that checks whether a stolen GitHub token remains valid and commits data with the prefix IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner. If the token later becomes invalid, the component executes a destructive command intended to delete the infected user’s home directory.
Python/PyPI Execution Path
The Python path uses a different execution model. The compromised PyPI package contains a malicious __init__.py file that downloads the next stage, transformers.pyz. Unlike the JavaScript path, which can run on Windows, Linux, and macOS, this Python variant is limited to Linux systems.
Before continuing, the Python payload performs several pre-execution checks. It exits if the host is not running Linux, if the system language appears to be russian, or if the machine has two or fewer CPU cores. It also attempts to install the cryptography package if it is missing and suppresses standard output and error streams to reduce visible signs of activity.
Once active, the Python payload functions as a credential aggregator. It dynamically loads collector modules and runs them in parallel, gathering data from local files, environment variables, cloud credentials, Kubernetes configurations, Vault instances, Docker containers, VPN tools, and password managers such as 1Password, Bitwarden, pass, and gopass.
The cloud-focused collectors target AWS, Azure, and GCP. The AWS collector searches environment variables, local credential files, and EC2 instance metadata, then attempts to enumerate values from AWS Secrets Manager and SSM Parameter Store. The Azure collector uses service principal credentials, client certificate authentication, Azure CLI token caches, or managed identity tokens to access subscriptions and Azure Key Vault secrets. The GCP collector uses service account files, application default credentials, refresh tokens, or metadata tokens to access Google Secret Manager.
The payload also targets Kubernetes and Vault environments.
The Kubernetes collector reads local kubeconfig files and in-cluster service account tokens, then attempts to enumerate and decode secrets across accessible namespaces and contexts. The Vault collector uses tokens from environment variables, local token files, AppRole credentials, or the Vault CLI, then walks through KV secret engines to retrieve stored secret values.
Collected data is compressed and encrypted before exfiltration. The payload uses AES-256-GCM to encrypt the collected data and RSA-OAEP with an embedded public key to wrap the AES key. It first attempts to send the encrypted package to a hardcoded command-and-control endpoint. If that attempt fails, it can query GitHub commit search for signed FIRESCALE messages and use a verified alternate endpoint.
As a fallback exfiltration path, the Python payload searches the collected data for GitHub tokens. If it finds a usable token, it creates a public GitHub repository with a randomized name and uploads the encrypted results as results.json.
JavaScript vs. Python Behavior
The JavaScript and Python paths share the same objective: harvesting credentials and enabling follow-on compromise. Their behavior, however, differs in several important ways.
The JavaScript variant provides broader supply chain capabilities. It supports cross-platform execution, uses Bun to run later-stage payloads, targets npm and GitHub publishing access, and includes functionality for npm package modification, GitHub Actions abuse, GitHub branch alteration, and persistence.
The Python variant has narrower platform support because it is restricted to Linux. However, it is highly focused on credential collection and encrypted exfiltration. It includes dedicated collectors for Azure Key Vault and GCP Secret Manager, in addition to AWS, Kubernetes, Vault, local files, Docker environments, VPN configurations, and password managers.
This reinforces the need to treat dependency installation and package import as security-sensitive events in automated development environments.
Mitigations and Remediations
- Versions of malicious packages should be pinned to a safe release that predates the infection, for example my_package==1.0.0.
- Announcements from the maintainers of infected packages should be monitored.
- Repositories should be scanned to determine whether they were affected by the malware. If infection is confirmed, the relevant variant should be identified correctly.
For the Python variant:
- Remove the persistence service.
- Remove the identified malicious files.
- Rotate exposed tokens, secrets, and passwords.
For the JavaScript variant:
- Remove the deadman-switch service.
- Remove the identified malicious files.
- Rotate exposed tokens, secrets, and passwords.
