Shai-Hulud and the npm Supply-Chain Crisis of 2026

If you ran npm install on a Tuesday in 2026, you may have shipped someone else's malware. That is not hyperbole. Between September 2025 and June 2026, the npm registry went from occasional typosquatting nuisance to the stage for the first true self-replicating worm the JavaScript ecosystem has ever seen. The npm supply-chain crisis of 2026 is the story of how attackers stopped phishing individual developers and started weaponizing the trust that lets one package quietly pull in three hundred others.

Here is what actually happened, who got hit, and the concrete steps that stop your pipeline from becoming the next propagation node.

The worm that publishes itself: Shai-Hulud

The defining event was Shai-Hulud, named after the sandworm from Frank Herbert's Dune. According to Palo Alto Networks' Unit 42, the first wave launched on September 15, 2025 and is regarded as the first genuine self-replicating worm in the npm ecosystem.

The mechanics are nasty in their simplicity. The worm executes during installation through package lifecycle scripts, harvests credentials from the host, and then uses any stolen npm publish tokens to republish the victim maintainer's other packages with the same malicious payload. Unit 42 noted it would enumerate roughly the top 20 packages a victim maintained and re-publish them, creating a cascade. Sysdig and others tracked the original wave to around 200 infected packages, including widely used libraries such as @ctrl/tinycolor and ngx-bootstrap.

It did not stop there. The campaign family evolved through three documented waves:

• Original (September 2025): ~200 packages, credential harvesting plus the auto-publish loop.
• Shai-Hulud 2.0 (November 2025): Unit 42 reported the payload moved to pre-install execution, meaning it ran on virtually every build server that processed an infected package, not just on developer laptops.
• Mini Shai-Hulud (late April 2026): First disclosed around April 29, 2026, this wave hit npm and PyPI simultaneously for the first time. The Cloud Security Alliance and Securonix tracked it across roughly 172 packages and 404 malicious versions, with infected packages collectively downloaded hundreds of millions of times per week.

The Mini Shai-Hulud variant added a chilling new trick: persistence through AI coding-agent configuration files, including Claude Code and VS Code settings. The worm understood that modern developers live inside AI tooling and planted itself there.

Axios: when 100M weekly downloads go rogue

Worms are scary because they scale. Targeted compromises of marquee packages are scary because of blast radius. On March 30, 2026, Axios — the JavaScript ecosystem's most popular HTTP client, with over 100 million weekly npm downloads — was compromised and turned into a delivery vehicle for a cross-platform remote access trojan (RAT).

Microsoft Threat Intelligence attributed the Axios compromise and its supporting infrastructure to Sapphire Sleet, a North Korean state-aligned actor. When a dependency that sits underneath a meaningful slice of all Node.js applications gets backdoored, the question stops being "are we exposed?" and becomes "how fast can we find out?"

The lesson from Axios is that popularity is not safety. A package with nine figures of weekly downloads is a more attractive target, not a less risky one, precisely because so much downstream software trusts it implicitly.

Red Hat, OIDC, and the CI/CD blind spot

The most instructive 2026 incident may be the smallest in scope. On June 1–2, 2026, attackers compromised at least 32 packages published under the @redhat-cloud-services npm namespace — 96 versions in total, per Aikido Security, with over 116,000 cumulative downloads.

What makes this case matter is how it happened. Per Cybersecurity Dive and Wiz, the malicious versions were published through GitHub Actions OIDC rather than stolen npm credentials. A compromised GitHub account pushed unauthorized commits into repositories in the RedHatInsights organization, and the CI pipeline dutifully published the result. The payload was a variant of Mini Shai-Hulud — a credential-stealing worm hunting CI secrets, cloud credentials, SSH keys, and npm tokens.

Red Hat stated the malicious code was never published for customer use and affected only internal development packages. But the takeaway is universal: if your CI/CD identity can publish, then compromising your CI/CD identity is enough. The npm supply-chain attacks of 2026 increasingly bypass the human maintainer entirely and go straight for the automation that publishes on their behalf.

Why this got so bad so fast

Three structural realities turned isolated incidents into a systemic crisis:

• Transitive trust. A typical Node project has thousands of transitive dependencies. You vet your direct dependencies; you almost never vet theirs.
• Lifecycle scripts. preinstall and postinstall hooks run arbitrary code during installation by default. That is the execution primitive every one of these worms relied on.
• Tokens everywhere. Long-lived npm publish tokens and broad cloud credentials sitting in CI environments are exactly what credential-stealing worms are built to grab — and then reuse to spread.

How to defend your pipeline right now

You cannot audit every transitive dependency by hand. You can shrink the attack surface dramatically with controls that map directly to how these attacks work.

Kill install-time code execution

• Run npm install --ignore-scripts in CI by default, and allowlist the handful of packages that genuinely need build scripts.
• Set ignore-scripts=true in your project .npmrc so the default is safe.

Lock and verify what you install

• Commit your lockfile and use npm ci, not npm install, in automated builds so versions are pinned exactly.
• Enable npm's --foreground-scripts and review packages that resolve from unexpected registries (the classic dependency-confusion vector flagged by Microsoft in May 2026).
• Add a cooldown: avoid auto-upgrading to versions published in the last 24–72 hours, the window when most of these malicious versions are caught and yanked.

Treat CI credentials as the crown jewels

• Replace long-lived npm publish tokens with short-lived, scoped tokens and enable npm's trusted publishing / provenance so packages are signed against their source build.
• Scope GitHub Actions OIDC to specific repositories and environments; the Red Hat case shows over-broad publish identities are the new soft target.
• Rotate any AWS keys, HashiCorp Vault tokens, and SSH keys exposed to build runners, and prefer just-in-time secrets over static ones.

Watch your AI tooling

Mini Shai-Hulud's persistence through Claude Code and VS Code config files means your editor and agent settings are now part of the attack surface. Keep those configs in source control so unexpected changes are visible in a diff.

The takeaway

The npm supply-chain crisis of 2026 made one thing undeniable: the registry is infrastructure, and infrastructure gets attacked. Shai-Hulud proved a worm can spread maintainer-to-maintainer without human help, Axios proved that the most-trusted packages are the highest-value targets, and the Red Hat OIDC compromise proved attackers will skip the developer and go straight for the robot that publishes. None of the defenses above are exotic — disabling install scripts, pinning with npm ci, and replacing long-lived tokens with provenance-backed publishing would have blunted every wave described here. The teams that came through 2026 intact were not lucky. They simply stopped trusting npm install by default.

FAQ

Is Shai-Hulud still active in 2026? The campaign family evolved through at least three waves into mid-2026, with Mini Shai-Hulud active from late April 2026 and related activity (such as the Red Hat compromise) appearing in June. Treat it as an ongoing threat pattern, not a closed incident.

Does npm audit catch these attacks? Not reliably in real time. npm audit flags known vulnerabilities after they are cataloged. Freshly published malicious versions can spread for hours before disclosure, which is why install-time controls and version cooldowns matter more than audit alone.

Are PyPI and other registries affected too? Yes. Mini Shai-Hulud was the first wave to hit npm and PyPI in a single coordinated operation, so the same defensive principles apply across ecosystems.