Shai-Hulud Supply Chain Attack Now Targets CrowdStrike’s npm Packages

The Shai-Hulud supply chain campaign has again struck, this time compromising multiple npm packages published under the CrowdStrike publisher account, according to the Socket Research Team.

The incident mirrors earlier attacks against popular packages such as TinyColor, but targets a new set of high-profile CrowdStrike packages, with the malware being identical to the previous campaign and including a bundle.js script that downloads and executes TruffleHog, searches hosts for tokens and cloud credentials, validates discovered credentials, creates unauthorized GitHub Actions workflows, and exfiltrates data to a hardcoded webhook endpoint.

The confirmed list of affected packages and versions includes @crowdstrike/commitlint@8.1.1, 8.1.2; @crowdstrike/falcon-shoelace@0.4.2; @crowdstrike/foundry-js@0.19.2; @crowdstrike/glide-core@0.34.2, 0.34.3; @crowdstrike/logscale-dashboard@1.205.2; @crowdstrike/logscale-parser-edit@1.205.1, 1.205.2; @crowdstrike/logscale-search@1.205.2; and @crowdstrike/tailwind-toucan-base@5.0.2, among others including related eslint, monorepo, and ember packages.

Socket notes that this persistence mechanism allows future CI/CD runs to continue leaking secrets, and researchers also highlighted nearly 700 GitHub repositories titled “Shai-Hulud Migration” linked to attacker automation. The overall targeting appears to be aimed at compromising both internal CrowdStrike tooling and community-facing packages, with a specific SHA-256 hash identified for the malicious file and an explicit exfiltration endpoint.