Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack

The Shai-Hulud 2.0 supply chain campaign represents a significant cloud-native ecosystem compromise, with attackers grafting malicious code into npm packages to harvest credentials and secrets. It involves malicious code that runs during the preinstall phase of infected packages, uses a Bun runtime, and then downloads a GitHub Actions Runner to establish a new repository and runner named SHA1Hulud.

The campaign has seen attacker activity such as fake commits, sometimes authored under the name “Linus Torvalds,” highlighting the need for commit signature verification. Microsoft Defender Security Research Team notes that defenders can detect and contain the threat via a layered approach, including scanning and credential rotation, isolating CI/CD agents, and reducing unnecessary permissions, with Defender for Cloud offering investigator-focused guidance.

According to Microsoft Defender Security Research Team, specific indicators of compromise include files like _setup_bun.js_ first seen on 24 November 2025 and _bun_environment.js_ first seen on 24 November 2025, with detections such as Sha1-Hulud Campaign Detected – Possible command injection to exfiltrate credentials and Suspicious usage of the shred command on hidden files.

Microsoft also provides hunting queries and guidance to surface compromised packages, map code repositories, and correlate telemetry across endpoints, containers, and cloud workloads to accelerate containment.