New Shai Hulud 3.0 malware variant raises fresh supply chain security concerns

A newly discovered third variant of the Shai Hulud malware is raising fresh concerns about the security of the open-source software supply chain, as researchers warn that the latest version shows more sophistication and improved stealth than earlier campaigns.

Shai Hulud is a malware campaign first observed in September targeting the JavaScript ecosystem. It focuses on supply chain compromise rather than traditional endpoint infection, using trojanized node packet manager or npm packages to steal credentials and propagate itself.

Shai Hulud 3.0, the latest evolution of the self-propagating worm, targets JavaScript developers through malicious npm packages. According to security researchers from Aikido Security NV, which first detected the new variant, the variant refines the techniques used in previous attacks while maintaining its core ability to spread laterally across developer environments and continuous integration pipelines.

The new variant includes technical improvements that are focused on improving resilience and evasion, including better error handling, more modular code, enhanced obfuscation techniques and broader compatibility across JavaScript runtimes, including Windows environments.

So far, Shai Hulud 3.0 has been distributed only through a smaller number of packages compared with earlier versions. The limited spread of the new variant may be intentional, as threat actors often test updated malware in controlled deployments before launching wider campaigns.

The continued evolution of Shai Hulud also highlights the growing attractiveness of developer environments as an attack surface. The idea, at its core, is a fairly simple one: embed malicious code into open-source dependencies to allow attackers to bypass perimeter defenses and gain access to systems that hold high-value secrets used for cloud infrastructure, source code repositories and deployment pipelines.

The new 3.0 variant of the Shai Hulud comes after a second variant of the malware was detected by managed detection and response company Expel Inc. just before Christmas.

Patrick Munch, chief security officer at agentic vulnerability management company Mondoo Inc., told SiliconANGLE via email that 3.0 is an “indiscriminate ‘fire and forget’ weapon with no way of calling off the attack” and that “its rapid evolution is a stark reminder that the software supply chain remains a primary target for threat actors.”

“Attacking the core of the software supply chain gives attackers a broad scope to harvest credentials and cause chaos,” he said. “We expect to see a rise in similar high-impact attacks across multiple software development ecosystems.”

Munch also believes that not only is this specific payload potentially extremely damaging, it also foreshadows future similar attacks.

Image: SiliconANGLE/Ideogram