Attackers deployed the Shai-Hulud malware in a new campaign targeting the npm registry after the code leaked publicly last week. Security researchers discovered multiple infected packages uploaded to npm over the weekend, each containing the infostealer payload.

Shai-Hulud operates as an information stealer designed to harvest sensitive data from compromised systems. The malware captures credentials, environment variables, and other secrets from developer machines. Once the code leaked, threat actors quickly weaponized it by packaging it into npm modules that mimic legitimate libraries.

npm packages reach millions of developers worldwide through automated dependency installation. A malicious package on the registry can compromise entire development pipelines if installed as a dependency. Developers often install packages without auditing source code, trusting the registry's vetting process.

The infected packages used naming conventions designed to deceive developers, such as typosquatting legitimate package names or using plausible-sounding identifiers. When installed, these packages execute the Shai-Hulud infostealer during the installation phase, before developers ever run their applications.

The attack leverages the trust developers place in public package repositories. Organizations using npm dependencies in their projects face exposure if they downloaded any of the malicious packages. The stealer targets sensitive data stored in development environments, including API keys, authentication tokens, and database credentials.

npm's maintainers removed the identified malicious packages, but the damage window remains open. Developers who installed these packages before removal have compromised systems. The leaked Shai-Hulud source code means additional variants will likely emerge as attackers modify the malware to evade detection.

This campaign underscores the supply chain risk inherent in open-source ecosystems. The npm registry processes thousands of package uploads daily, making complete vetting impractical. Developers should audit their dependency trees, implement package verification tools, and