Shai-Hulud 2.0 is here, and it’s the most dangerous npm supply-chain attack to date. This new wave doesn’t just reinfect packages: it installs its own runtime (Bun), steals credentials, plants hidden GitHub Actions backdoors, spreads across CI/CD pipelines, jumps ecosystems into Maven Central, and includes a destructive wiper capable of erasing home directories on all major OSes. Over 830+ npm packages were compromised within hours.
This is the first cross-registry worm in open source history, meaning Java teams were pulled into the blast radius without ever touching npm. Any developer or CI runner installing public packages may have been exposed.
If you want to understand how it spreads, why it’s so hard to detect, and what teams must do right now to contain it, this breakdown covers everything: Bun-based evasion, GitHub backdoors, mass propagation, IoCs, and urgent remediation steps.
The supply-chain threat model has changed. This attack proves it!
Read the full analysis for all the details and mitigation steps <a href="https://xygeni.io/blog/shai-hulud-20-npm-supply-chain-attack/?utm_source=dailydev&amp;utm_medium=post&amp;utm_campaign=Article" target="_blank" rel="noopener nofollow">Shai-Hulud 2.0 NPM Supply Chain Attack</a>
𝐁𝐮𝐢𝐥𝐝 𝐒𝐚𝐟𝐞, 𝐒𝐡𝐢𝐩 𝐒𝐭𝐫𝐨𝐧𝐠.

A squad for devs who care about security from the first line of code to production. Share tips, examples & tools to make software safer. Read, discuss, and collaborate, whether you’re a seasoned pro or new to secure coding!



SafeDev

Shai-Hulud 2.0 represents a major escalation in supply chain attacks, compromising over 830 npm packages within hours. This cross-registry worm installs its own Bun runtime for evasion, steals credentials, plants GitHub Actions backdoors, spreads through CI/CD pipelines, and even jumps to Maven Central, affecting Java developers. It includes a destructive wiper capable of erasing home directories across operating systems. The attack demonstrates new threat vectors requiring immediate containment measures including package audits, credential rotation, and CI/CD pipeline reviews.