Shai-Hulud Worm Evolves to Automate Package Registry Compromises and Credential Theft

Automated Package Registry Attacks Emerge

In September 2025, a worm named Shai-Hulud began automatically updating packages on npm's registry without human intervention. This worm published new versions containing hidden malware that would then propagate to more machines, leading to over 500 package versions being altered between September 14th and 18th. Stolen credentials were uploaded to a public GitHub repository named Shai-Hulud.

Evolution of the Threat

Two months later, in November 2025, Shai-Hulud 2.0 emerged, backdooring 796 packages and moving its execution earlier in the install process. This variant also included a destructive payload, deleting the user's home directory if it failed to find credentials or a way to spread. By spring 2026, Mini Shai-Hulud specifically targeted credentials for AI coding tools such as Claude, Codex, Cursor, and Gemini.

Bypassing Supply Chain Security

The most recent variant, ChainDrop, appeared in August 2026 and compromised over 400 packages in less than four hours. ChainDrop exploited legitimate, cryptographically signed release pipelines, which granted poisoned versions valid SLSA provenance attestations. This allowed it to circumvent mechanisms designed to verify package integrity. Its command infrastructure was also hosted on an Ethereum smart contract, making domain blocklists ineffective.

Implications for Software Supply Chain

These incidents highlight a fundamental vulnerability in package management systems, which assume that installing a package means running its contents with the installer's permissions. The automation of publishing by non-human agents, as demonstrated by these worms, challenges the traditional security model where human oversight was a key control point. The ability of these worms to bypass established security measures like SLSA provenance indicates a need for re-evaluation of current software supply chain security practices.