Shai-Hulud 2.0 Cyberattack Compromises 30,000 Repos and Exposes 500 GitHub Accounts
The Shai-Hulud 2.0 supply chain attack has emerged as a significant malware campaign impacting the developer ecosystem. First detected on Fri, Nov 24, 2025, the attack has been closely monitored by Wiz Research and Wiz CIRT, revealing a continuous spread…
The Shai-Hulud 2.0 supply chain attack has emerged as a significant malware campaign impacting the developer ecosystem. First detected on Fri, Nov 24, 2025, the attack has been closely monitored by Wiz Research and Wiz CIRT, revealing a continuous spread despite reduced infection rates.
The attack's scope includes approximately 24,000 compromised environment.json files containing critical system and credential information. The malware affected over 30,000 repositories, with 70% containing unique victim environments.
Notably, the malware exfiltrated over 500 GitHub usernames and tokens, enabling further attacks across multiple GitHub accounts and organizations.
This attack is characterized by its persistence, with new repositories emerging even six days post-detection. GitHub Actions is the primary CI/CD platform targeted, followed by Jenkins, GitLab CI, and AWS CodeBuild.
A notable resurgence was observed on Fri, Dec 1, 2025, with over 200 new infected repositories identified within a 12-hour window. The malware employs a sophisticated infection methodology, utilizing stolen credentials to propagate across new victims, complicating incident response.
The Shai-Hulud 2.0 supply chain attack has emerged as a significant malware campaign impacting the developer ecosystem.
The attack primarily exploits the npm ecosystem with malicious packages, but it has also impacted other software delivery channels. Specifically, AsyncAPI reported the exfiltration of npm tokens and an OpenVSX API key, affecting the AsyncAPI IDE extension.
Furthermore, the malware extended into the Java/Maven ecosystem, though active spread in Maven Central or OpenVSX was not observed at the time.
The volume of stolen credentials poses an immediate threat for downstream attacks. Analysis indicates approximately 60% of leaked npm tokens remain valid, and around 2.5% of secrets in truffleSecrets.json files were verified by the malware.
Despite efforts to address the issue, companies continue to document infections, and confusion persists regarding GitHub Actions security controls. The Shai-Hulud 2.0 incident highlights critical vulnerabilities in supply chain security practices.
Organizations are advised to strengthen GitHub Actions configurations, implement secret management strategies, and maintain vigilant monitoring for compromised credentials. The threat remains active, with potential risks extending for months.
Based on reporting by GBHackers.