Threat Actors Testing Modified and Highly Obfuscated Version of Shai Hulud Strain

Cybersecurity researchers have detected a new variant of the Shai Hulud malware, providing significant insights into the evolving strategies of threat actors.

The latest version of this malware demonstrates substantial changes from its original form, indicating deliberate improvements by individuals with access to the worm’s source code. This variant continues to target development environments, extracting sensitive information such as API keys, environment variables, and authentication credentials.

Shai Hulud operates by compromising JavaScript packages and spreading through supply chain infections. Once deployed, it can access GitHub repositories to extract valuable data, posing a significant concern for organizations relying on cloud development platforms and version control systems.

Aikido researchers identified this modified version by analyzing code differences that suggest intentional obfuscation. The evidence indicates that the creators of this variant had direct access to the original source code, systematically rewriting sections to evade detection and enhance functionality.

The new strain contains both errors and strategic improvements, reflecting the developers' workflow. Notably, a critical mistake was found where the malware attempts to fetch a file named "c0nt3nts.json" but saves it as "c9nt3nts.json" due to variable naming changes. This suggests errors during the obfuscation process.

Despite these errors, the updated version shows enhancements such as renaming the initial installation file to "bun_installer.js" and the main payload to "environment_source.js." Additionally, when leaking data to GitHub , the malware now identifies repositories with "Goldox-T3chs: Only Happy Girl," differing from previous naming conventions.

The new variant has eliminated the dead man switch mechanism, simplifying its operation and reducing detection opportunities. Furthermore, it now handles cross-platform compatibility more effectively by checking the operating system type and using the appropriate bun package manager executable. On Windows systems, it calls "bun.exe" instead of "bun," resolving a previous limitation.

The order of data collection has also changed, with environment variables now processed before application secrets, suggesting a refined data extraction pipeline.

These modifications indicate that Shai Hulud remains an active threat under continuous development. Organizations using JavaScript-based development environments should implement strict package verification processes, monitor for suspicious environment variable access, and maintain comprehensive logging of credential usage within their systems.

Based on reporting by Cyber Security News.