Shai-Hulud 2.0 Package Scanner

A Node.js script to check your npm packages against the list of packages compromised in the Shai-Hulud 2.0 supply chain attack (November 2025).

What is Shai-Hulud 2.0?

Shai-Hulud 2.0 is a sophisticated self-replicating worm that compromised 796+ npm packages in November 2025. The malware:

• Steals credentials (GitHub tokens, npm tokens, AWS/GCP/Azure keys, SSH keys)
• Exfiltrates data to GitHub repositories
• Self-propagates by publishing malicious versions of packages
• Installs persistent backdoors via GitHub Actions runners
• Can delete user data if propagation fails

Files Included

• check-shai-hulud.js - The scanner script
• shai-hulud-2_0.csv - List of 538 compromised package versions

Requirements

• Node.js (any recent version)
• Your project with package.json and ideally package-lock.json

Usage

Quick Check (Current Directory)

Navigate to your project directory and run:

node check-shai-hulud.js path/to/shai-hulud-2_0.csv

Check Specific Project

node check-shai-hulud.js path/to/shai-hulud-2_0.csv /path/to/your/project

Example

# If both files are in your project root
node check-shai-hulud.js ./shai-hulud-2_0.csv

# Check a different project
node check-shai-hulud.js ./shai-hulud-2_0.csv ~/projects/my-app

What the Script Does

1. ✅ Reads the compromised packages database (CSV)
2. ✅ Scans your package-lock.json (or package.json as fallback)
3. ✅ Checks both direct and transitive (nested) dependencies
4. ✅ Reports exact version matches against compromised packages
5. ✅ Provides clear remediation steps if threats are found

Understanding the Results

Clean Result ✅

✅ CLEAN: No compromised packages detected!

Scanned 247 package(s). Your project appears safe from this attack.

Compromised Packages Found 🚨

🚨 CRITICAL: 2 COMPROMISED PACKAGE(S) FOUND!

[1] posthog-node@5.13.3
    Type: dependency
    Direct dependency: Yes

[2] @asyncapi/parser@3.4.2
    Type: dependency
    Direct dependency: No (transitive)

If Compromised Packages Are Found

STOP IMMEDIATELY and follow these steps:

1. Do NOT run npm install until you've updated packages

2. Remove infected files:

   rm -rf node_modules package-lock.json
   npm cache clean --force

3. Update/remove compromised packages in package.json

4. Rotate ALL credentials:

   • npm tokens
   • GitHub Personal Access Tokens (PATs)
   • AWS/GCP/Azure credentials
   • SSH keys
   • Any other secrets that may have been exposed

5. Check for malicious artifacts:

   # Check for malicious files
   find . -name "setup_bun.js" -o -name "bun_environment.js"
   
   # Check for malicious workflows
   ls -la .github/workflows/ | grep -E "(discussion|formatter_)"
   
   # Check for unauthorized GitHub runners (requires gh CLI)
   gh api repos/{owner}/{repo}/actions/runners --jq '.runners[].name' | grep -i sha1hulud

6. Search for compromised repositories:

   • Check your GitHub account for repos with description "Sha1-Hulud: The Second Coming"
   • Look for repos with 18-character random alphanumeric names
   • Check for repos with "-migration" suffix

7. Fresh install with safeguards:

   npm install --ignore-scripts  # Prevents postinstall/preinstall hooks
   npm audit

How It Works

The script:

• Parses the CSV containing compromised package names and versions
• Reads your project's package-lock.json (preferred) or package.json
• Performs exact version matching (not just package name)
• Identifies both direct dependencies and transitive (nested) dependencies
• Exits with code 1 if compromised packages found (useful for CI/CD)

Limitations

• Requires exact version match (won't catch if you have different versions)
• CSV must be kept up-to-date as new compromised packages are discovered
• Only checks npm packages (not yarn berry PnP, pnpm, or other package managers)

Additional Resources

• CISA Alert on Shai-Hulud
• Wiz Research: Shai-Hulud 2.0
• Unit 42: Technical Analysis
• Datadog: IOCs and Detection

Contributing

To update the compromised packages list:

1. Add new entries to shai-hulud-2_0.csv in format: package_name,version
2. Keep the header row: package_name,package_version

License

This tool is provided as-is for security scanning purposes. Use freely.

---

Stay safe and keep your dependencies updated! 🛡️