Shai Hulud 2.0, now with a wiper flavor

Shai Hulud 2.0 is a two‑stage worm that spreads by compromising npm tokens to republish trusted packages with a malicious payload, infecting more than 800 npm packages in this version. According to Kaspersky, the campaign targets individuals and organisations worldwide, with infections most frequent in Russia, India, Vietnam, Brazil, China, Türkiye and France, and since September this year the firm has blocked over 1,700 Shai Hulud 2.0 attacks.

The initial bootstrap script masquerades as a routine Bun installation, after which bun_environment.js, a 10MB payload, carries out the main malicious activities. The malware harvests GitHub secrets, cloud credentials for AWS, Azure and Google Cloud, and uses TruffleHog to scan local files, exfiltrating data through a GitHub-hosted channel by creating a repository with a random 18-character name.

If no valid tokens are found, the malware triggers a destructive wipe of user files, primarily in the home directory, and Kaspersky classifies this family as HEUR:Worm.Script.Shulud[.]gen.