GitHub & npm under siege: megalodon, shai-hulud, and wormable malware redefine supply chain risk

The Megalodon campaign orchestrated a sweeping supply chain attack by injecting malicious CI/CD workflows into 5,561 GitHub repositories within a mere six hours, leveraging stolen developer credentials harvested from infostealer infections. These workflows stealthily exfiltrated a broad spectrum of sensitive secrets—including AWS, Azure, and Google Cloud tokens, SSH private keys, Kubernetes configurations, and GitHub OIDC tokens—once merged into repositories lacking strong branch protections, demonstrating how attackers exploited trust in automated pipelines to gain deep access to cloud and development environments.

By masquerading as benign bot personas and using maintenance-style commit messages, Megalodon’s attackers skillfully blended malicious activity into normal CI/CD workflows, evading detection and capitalizing on the industry's longstanding trust in automation and green checks. This tactic underscores the urgent need to treat AI-generated and bot-authored pull requests as untrusted external contributions, enforce rigorous review processes, and rotate secrets regularly to mitigate the risks posed by privileged automation within software supply chains.

The campaign’s impact rippled downstream beyond GitHub, contaminating npm packages such as multiple versions of @tiledesk/server (2.18.6 through 2.18.12), which were published from compromised repositories. This propagation highlights a critical security challenge: compromising CI/CD workflows can indirectly poison widely used open-source packages without directly breaching npm accounts, amplifying the attack surface and complicating remediation efforts across the software supply chain.

The Shai-Hulud campaign represents a sophisticated worm-like malware operation that hijacks OIDC tokens from GitHub action runners to poison CI/CD caches, enabling attackers to publish malicious versions of npm packages through legitimate, signed CI/CD pipelines. This tactic deceives developers into trusting compromised releases, as these appear to come from authoritative sources, thereby facilitating widespread malware propagation within the npm ecosystem.

By early 2026, Shai-Hulud had compromised over 600 npm packages, including high-profile ones from the TanStack suite and the AntV ecosystem, distributing infostealers and Phantom botnet malware. The campaign exploits token hijacking and poisoned package publishing to continuously override and release infected packages, which execute malicious build scripts upon installation, stealing sensitive information and perpetuating the infection cycle across thousands of CI/CD environments.

The attackers behind Shai-Hulud maintain extensive token access, enabling them to repeatedly compromise CI/CD pipelines and sustain a relentless infection cadence, with new malicious package versions published every few months. This rapid update and download cycle accelerates malware spread exponentially, as tens of thousands of downloads occur within minutes, further infiltrating multiple software companies’ systems—a scale so vast that experts express disbelief at the breadth of their access.

The compromise of widely used developer tools like the Nx Console VS Code extension has emerged as a critical vulnerability vector, enabling attackers to breach thousands of internal GitHub repositories. For instance, TeamPCP exploited stolen credentials to publish a malicious version of Nx Console (version 18.95.0), which was activated roughly 6,000 times within 40 minutes, harvesting sensitive tokens including AWS keys, GitHub tokens, and Kubernetes service accounts. This incident underscores how automated extension updates and trusted developer utilities have become prime targets for supply chain attacks, as evidenced by GitHub’s confirmation that about 3,800 internal repositories were accessed through this poisoned extension alone.

Attackers have increasingly leveraged stolen GitHub tokens and valid signing certificates to bypass traditional trust mechanisms within developer ecosystems. The Fox Tempest operation, for example, utilized a fraudulent code-signing service to deploy malware stealthily, while the Shai-Hulud campaign automated supply chain compromises using a self-spreading worm that created repositories containing encrypted stolen credentials. This evolution not only undermines npm’s Sigstore provenance verification—evidenced by over 600 malicious npm package versions signed with valid certificates—but also highlights how token theft and certificate misuse have become central to sophisticated, automated supply chain attacks.

The expanding attack surface of developer environments now includes IDEs, developer laptops, and CI/CD pipelines, where misconfigurations and token exploitation facilitate persistent breaches. Recent campaigns have chained GitHub Actions misconfigurations with OpenID Connect (OIDC) token theft to escalate privileges, establishing a recurring attack pattern that exploits automated workflows. Moreover, emerging threats like a VS Code zero-day enable attackers to silently steal GitHub OAuth tokens via malicious Jupyter notebooks, granting access to all private repositories accessible by the victim. This shift demands that organizations elevate developer endpoint hygiene to the same rigor as financial systems, incorporating strict token rotation, allowlisting of IDE extensions, and hardened CI/CD configurations.

The intricate interplay of credential theft, auto-execution of untrusted code, and vulnerabilities in AI-assisted coding tools collectively erodes the integrity of developer tool verification models. For example, AI coding CLIs such as Claude Code and GitHub Copilot auto-execute project-defined servers with full privileges upon folder trust acceptance, enabling attackers to exfiltrate secrets without sandboxing. Additionally, malicious instructions embedded in GitHub pull request titles have caused AI code review tools to leak API keys, with some vulnerabilities rated CVSS 9.4 Critical. These multifaceted weaknesses call for comprehensive audits and security hardening, as exemplified by Grafana Labs’ proactive token rotation and commit auditing following token exploitation incidents.

By early 2026, supply chain attacks have transitioned from isolated incidents to a pervasive threat targeting open source ecosystems and developer tools with alarming frequency and complexity. Campaigns like Shai-Hulud have introduced wormable malware that propagates through compromised npm packages, highlighting a new era of automated, persistent infections that worm their way through repositories and CI/CD pipelines alike. This evolution underscores how attackers exploit the inherent trust in software supply chains, turning developer dependencies into vectors for widespread compromise.

The Miasma campaign exemplifies a strategic shift in attacker focus from merely compromising package repositories to infiltrating CI/CD workflows and developer toolchains themselves. Originating from a Red Hat employee’s GitHub account compromise, Miasma leverages GitHub Actions OIDC workflows to inject malicious code, distributing malware through trusted pipelines while harvesting a broad spectrum of credentials—from AWS and Azure keys to GitHub tokens and SSH keys. This approach not only amplifies the attack’s reach but also exposes critical weaknesses in automated pipeline security and token management.

Miasma’s evolution into a true worm targeting AI developer ecosystems such as Claude Code, Gemini CLI, and VS Code AI extensions marks a significant escalation in supply chain attack sophistication. By harvesting API keys, session tokens, and development secrets, then stealthily propagating malicious commits under legitimate developer identities, Miasma exploits the deep integration of modern development environments with cloud infrastructure and production credentials. This shift from attacking applications to targeting the very people and tools responsible for building software highlights a critical new front in supply chain security.

The Mastra npm compromise reveals advanced attacker tactics that combine typosquatting, dependency injection, and staged payload delivery to infiltrate developer workflows at scale. By hijacking the ehindero maintainer account and bypassing automated CI/CD security controls—evidenced by manual publishing via anonymous email services—attackers executed obfuscated postinstall hooks that disable TLS verification and deploy multi-stage payloads. This sophisticated blend of vendor namespace exploitation and evasive techniques demonstrates how supply chain threats continue to evolve, emphasizing the urgent need to secure publisher credentials and harden automated build environments.