nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Shai-Hulud 3.0: New Malware Signals Evolving Supply Chain Threats

Du'aine Davis · 2026-01-08T17:03:57+00:00

Observed in the wild * On 29 December, a security researcher discovered a new variant of the Shai-Hulud malware, dubbed “The Golden Path” (v3.0), embedded in the @vietmoney /react-big-calendar npm package (v0.26.2). This appears to be a technical evolution rather than a copycat, with reports limited to a single package,…

Du'aine Davis

Observed in the wild

On 29 December, a security researcher discovered a new variant of the Shai-Hulud malware, dubbed “The Golden Path” (v3.0), embedded in the @vietmoney /react-big-calendar npm package (v0.26.2). This appears to be a technical evolution rather than a copycat, with reports limited to a single package, suggesting a testing phase during the holiday period when response times are slower.
The malware was introduced via npm supply chain compromise, leveraging postinstall scripts and refined obfuscation techniques to bypass detection. The updated logic is more resilient and cross-platform compatible, indicating continued sophistication by threat actors exploiting seasonal operational gaps.
Organisations should enforce npm security best practices, including setting ignore-scripts=true in .npmrc, using session-based authentication and CLI token management, and running npm ci or pnpm with --ignore-scripts. Microsoft Defender users should monitor for unexpected script execution during package installation and apply behavioural detection for anomalous CLI activity.chains.

Shai Hulud strikes again - The golden path

The Holiday Whisper: Shai-Hulud 3.0 | Snyk

Find more posts tagged with

Threat Landscape

Sign in to participate and unlock exclusive content 🔓

It looks like you're new here! Sign in or register to be able to comment, access member-only content and follow the spaces relevant to you.

Comments

Du'aine Davis

“Mini Shai‑Hulud” supply-chain attack targets npm and PyPI packages
Since 29 April, the “Mini Shai‑Hulud” supply-chain campaign has compromised packages on npm and PyPI. Confirmed malicious releases include SAP CAP tools (mbt, @cap-js /*), intercom-client@7 .0.4 (npm), and PyPI lightning 2.6.2/2.6.3. Affected versions may expose cloud credentials and other secrets during install or import.

These packages can run automatically at install time (npm preinstall) or when imported in Python, download the Bun runtime, then execute hidden JavaScript to steal credentials. Data may include AWS/Azure/GCP credentials, SSH keys, GitHub/npm tokens, and CI secrets; it is encrypted and sent via attacker-controlled GitHub repos. Stolen tokens may be reused to publish further malicious versions. Socket attributes this to TeamPCP with high confidence.

Organisations are advised to remove affected versions; rotate potentially exposed credentials/tokens; and review CI logs for unexpected installs/imports. In Microsoft Defender, hunt for Bun runtime execution, suspicious Node.js preinstall activity, unusual outbound GitHub traffic from build agents, and creation/modification of .vscode/tasks.json or .claude/settings.json. Enforce an approved-package list and dependency integrity checks.

Mini Shai-Hulud - Socket

Du'aine Davis

Mini Shai-Hulud Expands via TanStack npm Supply Chain Compromise

Building on earlier Mini Shai-Hulud reporting, attackers in May 2026 distributed 84 compromised TanStack npm package versions, including widely used libraries with millions of weekly downloads. This significantly increases the campaign’s reach, exposing a large number of organisations through trusted software dependencies used in development and build environments.
The activity follows the same pattern as earlier incidents linked to “TeamPCP”, where attackers insert malicious code into legitimate packages and push updates through normal development workflows. The malware is designed to quietly collect credentials from development and cloud environments and then spread further by modifying and republishing additional packages.
Organisations are advised to treat this as part of an ongoing campaign: rotate any credentials used in development or build systems and review pipelines for unexpected changes or package updates. In Microsoft Defender, focus on identifying unusual behaviour such as unexpected script execution, new or modified developer tooling files, and systems making unexpected network connections during package installation.

TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud...

See what's trending

Click on a tag to discover all the published content related to it.