翻訳待ち：Shai-Hulud was the best thing to happen to supply chain security

AI サービスが一時的に利用できないため、復旧後に翻訳を補完します。

Shai-Hulud was the best thing to happen to supply chain security We might Shai-Hulud to thank for convincing the community to use Trusted publishing Charlie Eriksen Published on: Aug 24, 2026 Last updated on: Aug 26, 2026 npm launched Package Provenance in late 2022. For two years, adoption averaged 20-50 packages per week. Followed by Trusted Publishing in 2024. Blog posts were written. CISA advisories were issued. The line barely moved. Eventually Trusted Publishing with OIDC was made Generally Available in July 2025 Then Shai-Hulud hit. Weekly adoption jumped to 430 packages. In 18 months, cumulative adoption grew 3.4x. We're still only at 25% of total download volume covered, just 11,001 of the top 51,370 packages have adopted it. But the attacks moved the needle more than anything the security industry did. Here's the data. What Trusted Publishing is Trusted Publishing replaces long-lived npm API tokens with short-lived, per-run credentials issued via OpenID Connect. Instead of storing NPM_TOKEN in your GitHub repo secrets indefinitely, your CI pipeline gets a token that expires in minutes. Nothing to steal. Nothing to exfiltrate. The attack wave that changed things August 26, 2025: S1ngularity. Attackers exploited a GitHub Actions misconfiguration in the Nx monorepo to execute code from a malicious fork in the upstream repo's trusted context, stealing the npm publishing token. Malicious versions of several Nx packages were live for four hours, scanning developer machines for credentials, SSH keys, crypto wallets — and notably, actively searching for installed AI CLI tools to run them with --dangerously-skip-permissions and extract filesystem contents. That week: adoption ticked up noticeably for the first time. September 8, 2025: Debug/Chalk. A maintainer was phished via a fake npm support email (sent from npmjs.help) that harvested their credentials and live TOTP code. 18 packages with over 2 billion combined weekly downloads were backdoored with a crypto-theft payload that silently intercepted browser wallet interactions and redirected funds. Malicious versions were live for two hours. That week: 103 new packages adopted Trusted Publishing. September 15, 2025: Shai-Hulud wave 1. A self-replicating worm hit the npm ecosystem. When a compromised package found additional npm tokens in its environment, it automatically published malicious versions of anything else it could reach. Result: 700+ packages compromised, 27,000 malicious GitHub repositories, 14,000 secrets exposed across 487 organizations. CISA issued an alert September 23. That week: 109 new packages. November 23, 2025: Shai-Hulud 2.0. A Pwn Request against the asyncapi/cli repository exfiltrated the CI token in under three minutes, then used it to deploy the worm via a malicious OpenVSX extension. The campaign spread to 25,000+ malicious repositories. Microsoft published guidance on December 9. That week: 372 new packages. The previous two-year weekly average was around 40. November 24, 2025: SHA1-Hulud. A parallel wave hit Zapier, ENS Domains, and others. Long-lived credentials were found sitting in compromised repositories. npm's security team explicitly recommended Trusted Publishing as the fix. That week: 120 new packages. March 20–21, 2026: CanisterWorm. TeamPCP deployed an npm worm via stolen tokens. 28+ packages infected in under 60 seconds; the payload harvested credentials and self-propagated. That week: 112 new packages. March 31, 2026: Axios. Sapphire Sleet (North Korea) compromised a maintainer account and published two backdoored versions 39 minutes apart, each injecting a fake dependency that silently downloaded a cross-platform remote access trojan. The malicious packages were live for three hours. Axios has 100M+ weekly downloads. That week: 138 new packages. April 8–22, 2026: CanisterSprawl. A second TeamPCP npm worm using a new ICP canister. When PyPI tokens were discovered in infected environments, it jumped ecosystems via .pth injection. That week: 163 new packages. April 29–30, 2026: Mini Shai-Hulud I. TeamPCP pivoted from token theft to stolen CI credentials. A cross-ecosystem attack hit npm, PyPI, and Packagist in 24 hours via compromised CircleCI tokens. That week: 121 new packages. May 7–11, 2026: Mini Shai-Hulud II / TanStack. Here's the escalation that changes everything: they didn't steal a token. TeamPCP used a Pwn Request to poison the GitHub Actions cache, then waited for the legitimate release workflow to run. When it did — with id-token: write permissions — attacker-controlled code from the poisoned cache extracted the OIDC token from runner memory and exchanged it through npm's own token endpoint. The published packages carried valid SLSA Build Level 3 provenance attestations. Trusted Publishing wasn't bypassed. It was used as the attack vector. 170+ packages across npm and PyPI in 5 hours. May 18–19, 2026: Mini Shai-Hulud III / Nx & AntV. The Nx Console VS Code extension was compromised using credentials stolen during the TanStack attack — five days of dwell time before use. 639 @antv npm versions were poisoned via a stolen maintainer account, each installing a persistent kitty-monitor backdoor. That week: 144 new packages. The week after: 430. An all-time high. June 1–7, 2026: Miasma / Hades. The attack class shifted again. Wave 1 published 90 malicious npm versions targeting Red Hat Cloud Services packages — not by stealing OIDC tokens, but by abusing the OIDC publishing endpoint directly. Wave 2 added a binding.gyp technique to bypass install-script detection. By wave 4 (Hades), the campaign had crossed to PyPI via .pth startup execution, poisoning 37 wheels across 19 packages. Red Hat issued RHSB-2026-006. That week: 209 new packages. The pattern, and how it escalated The early attacks followed a familiar script: phish a maintainer, steal a long-lived token, publish malware, spread to everything else the token can reach. Debug/Chalk was a phishing attack. Axios was a compromised maintainer account. But the more sophisticated attacks went after the CI pipeline itself. S1ngularity and Shai-Hulud 2.0 both used Pwn Requests, malicious pull requests that exploited vulnerable pull_request_target GitHub Actions workflows to execute attacker code inside the upstream repo's trusted context. They didn't need to steal a stored token. They just needed the CI runner to have one. Mini Shai-Hulud II was the logical endpoint of one progression. Once you control the runner, you can extract whatever ambient credentials are present, including short-lived OIDC tokens. The packages it published looked legitimate by every automated check: valid provenance, real maintainer identity, correct signing. The attack had evolved from exploiting stored secrets to exploiting the build process itself. Miasma escalated further still. It didn't need to extract a token at all: it abused the OIDC publishing endpoint directly. Each wave introduced a new detection-bypass technique. The postmortems kept naming the same failures. The attacks kept finding new ways around the recommended fixes. Attack Date New packages that week Feature launch Dec 2022 4 2-year average 2023-2024 ~35 S1ngularity Aug 26, 2025 52 Debug/Chalk Sep 8, 2025 103 Shai-Hulud v1 Sep 15, 2025 109 Shai-Hulud 2.0 Nov 23, 2025 372 SHA1-Hulud Nov 24, 2025 120 CanisterWorm Mar 20, 2026 112 Axios Mar 31, 2026 138 CanisterSprawl Apr 8, 2026 163 Mini Shai-Hulud I Apr 29, 2026 121 Mini Shai-Hulud II May 7, 2026 126 Mini Shai-Hulud III May 18, 2026 144 Mini Shai-Hulud (peak) May 25, 2026 430 Miasma Jun 1, 2026 209 The attack surface is now meaningfully smaller than 18 months ago. Not because the security industry convinced people. Because packages got backdoored, and then maintainers changed their setup. That's not a win for security education. It's a data point about how security decisions actually get made in practice. Who was this? During the Shai-Hulud 2.0 campaign, the attacker renamed their GitHub account to UnknownWonderer1 — almost certainly a reference to the Zensunni Wanderers from Dune: the persecuted nomads who became the Fremen, the only culture that learned to live in harmony with Shai-Hulud. The name is not the work of someone who stumbled into the ecosystem. It is the name of someone who had been thinking about it. The malware design reinforces that read. S1ngularity didn't quietly exfiltrate credentials — it injected a shutdown command into the shell profile, something that would visibly kill your machine the next time you opened a terminal. That is not the behaviour of someone trying to stay hidden. Every campaign stopped well short of what it could have done. A worm that self-propagates to 700+ packages but restrains its payload is making a choice. They also understood the incentive structure better than the ecosystem did. Maintainers are rarely paid to secure packages. The blast radius of a breach lands on downstream users, not on the person who left the token in CI. The platforms with the power to mandate secure publishing feel the least pain when it goes wrong. It is a classic collective-action failure — and 40,000 unprotected packages after three years of advisories is exactly what that structure produces. This attacker understood why nothing was moving. And they decided to apply a different kind of pressure. Warning shots I wrote about this at the time: the naming, the restraint in the malware design, and the way the attacks consistently stopped short of full exploitation. My read is that Shai-Hulud was not primarily a criminal operation. It was a message — from someone who understood the ecosystem well enough to know exactly which pressure points would make it move. The Fremen pray that the Maker's passage will cleanse the world. The attacker appears to have reached a similar conclusion: only visible pain would force the ecosystem to confront what made the worm possible. To the Fremen, Shai-Hulud is not simply a destructive animal. It is the Maker. Its passage tears through the desert, but it also cleanses and enforces the laws by which everything in that ecosystem must live. They did not merely release Shai-Hulud. They chose to play the Wanderer who understood why it had to come. Why we still haven't fixed it The warning was issued. The ecosystem didn't move fast enough. The open-sourced Shai-Hulud playbook then got picked up by actors with no interest in sending a message — TeamPCP, Sapphire Sleet, and others who went straight for credential theft, crypto wallets, and remote access. Frameworks like Mastra became victims. The worm that started as a demonstration became a template. The frustrating part is that the holdout isn't a technical difficulty. Trusted Publishing is free and takes ten minutes. The holdout is that the cost of not doing it hasn't landed on the right person yet. Maintainers bear the reputational risk if their package gets compromised, but the actual damage lands downstream on teams who didn't write a single line of the affected package. That misalignment is structural. Attacks spike adoption temporarily, then urgency fades, and the next cohort of packages defaults back to long-lived tokens. Look at the chart. The spikes are real. So is the decay between them. And Mini Shai-Hulud added a new wrinkle: even packages that adopted Trusted Publishing can be compromised if the underlying CI pipeline isn't hardened. Extracting an OIDC token from runner memory is harder than stealing a stored secret. But it's not impossible, and the attack now has a public proof of concept. Trusted Publishing removes one attack vector. It doesn't remove all of them. The accountability gap, and what to do about it Axios had over 100 million weekly downloads and hadn't adopted Trusted Publishing before North Korea compromised it. Someone could have filed a PR a year earlier. Nobody did. That's the accountability gap. The security com [truncated for AI cost control]