{
  "id": 4669413,
  "title": "Shai-Hulud: Whoever controls your package registry controls your pipeline",
  "url": "https://urgent.news/2026/08/31/shai-hulud-whoever-controls-your-package-registry-controls-your",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T16:00:00.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/shai-hulud-pipeline-security/"
  },
  "original_language": "en",
  "account": "In September 2025, npm's registry experienced an unprecedented event - packages began updating themselves without any human intervention. Within four days, more than 500 package versions were altered, all while the malicious code left a signature with the name Shai-Hulud, taken from Frank Herbert's Dune series. This was just the beginning of a series of increasingly sophisticated attacks.\n\nThe second iteration, Shai-Hulud 2.0, released two months later, managed to backdoor 796 packages, manipulate the install process, and delete user home directories if it couldn't find credentials or a way to spread. By 2026, the damage was extensive, with a variant targeting AI coding tools, which are now considered a prime target for exploitation.\n\nThe latest variant, ChainDrop, appeared in August 2026, and managed to compromise over 400 packages by riding the legitimate release pipeline. It used cryptographically signed releases to bypass security measures that were designed to prevent tampering. The command infrastructure for ChainDrop was even hosted inside an Ethereum smart contract, making it almost impossible to block.\n\nThe core issue lies in the trust placed in package managers and infrastructure registries. When publishing was a manual process, this assumption was safe. However, with automated publishing by non-human agents, this safety net has vanished. All it takes is one compromised credential and an install script for the worm to take control.\n\nThe strategy is simple: a compromised npm package runs a postinstall script that searches for credentials, downloads Trufflehog to confirm their validity, and then exfiltrates them to a new public GitHub repository. If it finds an npm token, it calls the registry's API to list every package the compromised developer maintains, injects itself into the postinstall step, bumps the version number, and republishes them.\n\nWhile the vulnerability is not specific to npm, it can affect any system where a maintainer's account has write access to a public registry. The industry's current answer is provenance, which involves signing packages and attesting to the build. However, ChainDrop demonstrated that even this is not foolproof. It compromised a maintainer account with legitimate write access and used its legitimate pipeline to build and publish the malware.\n\nThe solution lies in pinning dependencies to an immutable reference. For example, Terraform uses a cryptographic checksum for every provider version in its dependency lock file, .terraform.lock.hcl. Once a checksum is recorded, any future terraform init that doesn't match it fails, preventing the acceptance of a swapped-out binary. Similarly, modules should be pinned to a full commit SHA, not a branch or tag. By doing so, we can ensure that the code we run has not been tampered with, even in an environment where automated publishing by non-human agents is possible.",
  "summary": "On September 15, 2025, npm’s registry did something unprecedented: Packages began updating themselves. No maintainer ran npm publish. No pull The post Shai-Hulud: Whoever controls your package registry controls your pipeline appeared first on The New Stack .",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}