Shai-Hulud

THREAT ACTOR PROFILE

Shai-Hulud

Shai-Hulud is a self-propagating supply-chain worm that spreads through the npm ecosystem, compromising package maintainers and backdooring hundreds of packages with huge download counts. It steals developer and cloud credentials, publishes them to public repositories, and propagates automatically, with successive waves (Shai-Hulud 2.0, CHAINDROP and Mini Shai-Hulud) affecting a large share of the Fortune 100.

Country:

Not attributed

Supply chain / eCrime

First seen

2025

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Shai-Hulud and its successive waves

Shai-Hulud is tracked under its own name and the labels of its successive campaigns. It maps to one entry among the supply-chain threat actors we profile, and its blockchain-based C2 resolution overlaps with operations like The Gentlemen.

GROUP PROFILE

A worm that eats the software supply chain

Shai-Hulud is defined by self-propagation. Once it compromises a maintainer account, its payload steals secrets and uses them to publish malicious versions of further packages, spreading across the npm graph without direct operator action.

Our record ties it to npm supply-chain compromise and credential theft. Elastic documented the CHAINDROP worm backdooring 400+ packages with over a billion monthly downloads, and Wiz tracked the long tail of Shai-Hulud 2.0 affecting over a third of the Fortune 100.

The group's tradecraft uses malicious preinstall hooks, the Bun runtime, cross-platform credential stealers, and exfiltration endpoints resolved through Ethereum smart contracts for resilience.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Maintainer compromise into worm propagation

The stages below come from Shai-Hulud activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

CHAINDROP and the worm payloads

Initial Access

CVES EXPLOITED

Credential theft and package abuse, not CVE exploitation

Shai-Hulud spreads through compromised maintainer accounts, stolen credentials and malicious package hooks rather than exploiting a consistent set of software vulnerabilities, so this profile does not list a confirmed exploited-CVE set tied to the worm. Detection should focus on anomalous package publishes, malicious preinstall hooks, Bun-based loaders and exfiltration to public repositories or blockchain-resolved endpoints.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

CHAINDROP, the Third Coming and the long tail

Recent reporting tracks the worm's successive waves.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through