Jack of all trades: Shai‑Hulud malware steals secrets, AIPAC data breach uncovered

TL;DR

• Shai‑Hulud malware trojanizes npm packages, compromising over 27,000 GitHub repositories and exfiltrating developer secrets.
• AIPAC data breach exposes sensitive personal information, sparking ongoing investigation.
• Iberia airlines data leak reveals 77 GB of internal data, costing approximately €150,000.

Shai‑Hulud’s NPM Onslaught: A Wake‑Up Call for the Open‑Source Ecosystem

The Threat Unfolding

• 21 Nov 2025 – A new malicious npm package appears, masquerading as a Bun installer. Its preinstall script drops a 10 MB loader (bun_environment.js).
• 22 Nov 2025 – Security firms Wiz and Aikido flag the first 27 600 GitHub hits, tracing 35 compromised maintainer accounts.
• 23 Nov 2025 – Koji logs over 800 infected bundles; automated publishing churns out roughly 1 000 new repositories every 30 minutes for a 12‑hour span.
• 24 Nov 2025 – Follow‑up alerts confirm 27 % of surveyed cloud/code environments host at least one tainted module, and public advisories detail exfiltration of npm tokens, cloud keys and CI/CD variables.

How It Works

• Trojanized versions of popular libraries (e.g., zapier-platform-core, ensjs, postman-collection-fork) embed malicious preinstall hooks.
• The hook runs setup_bun.js, which fetches cloud.json, contents.json and truffleSecrets.json – all marked with “Sha1‑HULUD”.
• TruffleHog‑derived logic scans for secrets, harvesting npm authentication tokens, AWS/GCP/Azure credentials, and environment variables from CI pipelines.
• Stolen npm tokens are immediately reused to publish fresh malicious releases, creating a self‑propagating feedback loop that bypasses manual credential theft.
• Collected credentials are pushed to attacker‑controlled GitHub repos, exposing over 27 000 compromised repositories.

The Scale of Damage

• Compromised packages: between 187 confirmed and more than 800 identified.
• Maintainer accounts at risk: 35‑350 unique identities.
• GitHub exposure: > 27 000 repositories, 27 600 search hits.
• Total downloads of infected packages: roughly 132 million.
• Penetration rate: about 27 % of surveyed environments contain malicious code.

What’s Next

• npm is expected to enforce immediate revocation of classic tokens after industry pressure.
• Lockfile verification and signed lockfiles will become default safeguards.
• Threat actors are likely to replicate this playbook on other registries (PyPI, RubyGems) to broaden reach.
• Static analysis tools will adopt heuristics targeting preinstall scripts that fetch remote code or reference “Sha1‑HULUD”.
• Regulatory bodies (US‑CERT, OpenSSF) may mandate token rotation within 48 hours of any supply‑chain alert.

What We Must Do

• Revoke every npm token associated with compromised accounts and enable two‑factor authentication for new tokens.
• Integrate automated scans that flag preinstall hooks executing remote fetches or referencing unusual identifiers.
• Pin critical dependencies to explicit shasums and use npm ci to avoid unverified upgrades.
• Deploy continuous monitoring of npm publishes for high‑value namespaces such as Zapier, ENS and Postman.
• Establish an incident‑response playbook that isolates infected GitHub repos, invalidates leaked credentials, and captures payload artifacts for forensic analysis.

Supply‑Chain Intrusion Exposes AIPAC Donor Data

Incident Snapshot

• Target: American Israel Public Affairs Committee (AIPAC)
• Vector: Compromised credentials in a third‑party cloud service, mirroring the simultaneous Salesforce‑Gainsight breach
• Extracted assets: names, emails, phone numbers, donor contribution records, internal policy documents

Threat Landscape Context

• Supply‑chain attacks dominate recent reports, with the Gainsight platform and Eurofiber ticketing system both breached.
• Ransomware continues to pressure sectors; notable victims include LG Energy Solution and Pajemploi.
• Zero‑day exploits such as CVE‑2025‑58034 (Fortinet) and a Chrome V8 type‑confusion flaw are actively weaponized.
• Political advocacy groups increasingly appear in attacker plans, leveraging indirect cloud compromises to bypass perimeter defenses.

Data‑Driven Indicators

• Overall breach activity spans roughly 300 organizations; the AIPAC case fits within this wave.
• Related leaks involve about 2.3 TB of sensitive files, suggesting a comparable data volume for AIPAC.
• Geographically, the exposure is U.S.–centric, but the supply‑chain nature invites potential spill‑over through partner networks.

Pattern Analysis

• Cloud services serve as initial footholds; attackers target SaaS environments to reach high‑value targets.
• Reuse of admin credentials across platforms facilitates lateral movement, likely a factor in this breach.
• The AIPAC disclosure followed the Gainsight incident by less than 48 hours, indicating coordinated exploitation campaigns.

Emerging Trends

• Supply‑chain tactics now merge with political targeting, reflecting a shift toward influence‑focused data theft.
• Zero‑day weaponization is accelerating, with multiple high‑severity flaws exploited concurrently.
• AI‑generated phishing is rising; similar methods likely obtained the compromised AIPAC credentials.

Risk Assessment

• Confidentiality impact: 5 / 5 – donor identities and contribution details are highly sensitive.
• Operational disruption: 2 / 5 – no service outage reported.
• Reputation damage: 4 / 5 – donor trust is essential for advocacy groups.
• Secondary exploitation likelihood: 3 / 5 – stolen data may fuel targeted phishing against allied NGOs.

Predictive Outlook (12 Months)

• Regulators in the U.S. and EU are expected to issue advisory notices mandating tighter access‑control audits for political NGOs.
• Adoption of zero‑trust architectures will likely accelerate, emphasizing continuous authentication and micro‑segmentation in cloud environments.
• Intelligence forecasts at least two additional campaigns aimed at donor registries of U.S. political advocacy groups.

Actionable Recommendations

• Rotate all cloud service credentials immediately and enforce multi‑factor authentication.
• Compile a complete cloud asset inventory to expose shadow SaaS applications.
• Implement anomaly‑based user‑behavior analytics to detect abnormal data‑access patterns.
• Engage forensic specialists experienced in supply‑chain breach investigations to map the intrusion path.
• Issue breach notifications to affected donors in line with statutory requirements to limit identity‑theft risk.