Some of the companies cleaning up after the Shai-Hulud supply chain worm have run into a problem most incident response playbooks never anticipated: the software they are restoring from is part of the compromise. Sygnia's incident response team says it has worked cases where a victim not only published poisoned packages to its own customers but also consumed those packages internally, so bringing a rebuilt system back online could set the infection off again somewhere else.
That turns a cleanup into a trap. Deleting the malicious package is not the end of the job.
Stolen keys do the walking
Shai-Hulud is self-propagating malware that spreads through the systems developers use to build and ship software rather than through the software itself. Sygnia says the campaign first appeared in September 2025 and has kept changing since. The pattern it sees is consistent: attackers compromise the maintainer of a widely used package, usually by phishing them or exploiting a weakness in their release workflow, then push malicious code out through that maintainer's legitimate pipeline. Install scripts run it automatically on whoever pulls the release.
What the malware wants is secrets. On a developer laptop or a build runner it goes looking for publishing keys, GitHub and GitLab tokens, cloud and Kubernetes credentials, Vault credentials, SSH keys and CI/CD secrets, and Sygnia notes it borrows the same techniques legitimate scanning tools use to find secrets buried in source code. In an ordinary intrusion an attacker moves from machine to machine. Here the credentials are the movement: a single build runner may hold access to source repositories, cloud services, deployment systems and production, so one compromised workload reaches all of them without touching the network in between. Publishing credentials are the worst case, because they let the attacker cut a new poisoned release and start the cycle over.
Exfiltration a domain block will not catch
Sygnia also reports seeing a smart contract and blockchain infrastructure used as part of the exfiltration path in activity it discussed in a recent webinar, which it says makes traditional domain-based blocking less effective. Some variants add persistence as well, running processes on developer workstations or quietly registering extra self-hosted runners. The campaign has turned before: the worm adapted to slip past AI security scanners earlier this year, and a descendant later hijacked npm packages to steal cloud keys from developers.
Rotating a secret is not revoking it
The response problem is scale. Teams can find themselves staring at hundreds or thousands of possibly exposed secrets with no immediate way to tell which are still valid, who owns them, or what they unlock. Sygnia flags a distinction that gets missed under pressure: for some credential types, rotating a secret without revoking the old value leaves the old one usable. Without a central record of what has been dealt with, two teams rotate the same key twice while another is missed entirely.
Rebuild the pipeline, do not just clean it
Sygnia's advice is to recover from infrastructure you can actually trust, which in practice means freezing affected pipelines, rebuilding compromised runners, removing persistence and restoring development infrastructure from known-good sources, rather than deleting the offending package and moving on. It also warns responders to preserve evidence about exposed credentials first, because remediation can erase the trail investigators need to work out whether the attacker ever used them.
For the next campaign, the firm points to controls that shrink the blast radius: inventory the secrets in CI/CD pipelines before an incident, segregate them so that compromising one workflow does not expose the whole delivery environment, treat build runners as untrusted execution environments with restricted egress and real telemetry, and pin dependencies to immutable references such as a reviewed commit SHA, since a mutable version tag can be repointed at a malicious release once a maintainer falls. The full write-up is in Sygnia's report on responding to Shai-Hulud incidents.
The uncomfortable part is what all of this says about where these attacks are heading. The prize is no longer a popular package. It is the machinery that decides what a trusted package is.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.