Shai Hulud v2 Exploits GitHub Actions to Steal Secrets

A sophisticated supply chain attack has compromised hundreds of npm packages and exposed secrets from tens of thousands of GitHub repositories, with cybersecurity researchers now documenting how attackers weaponized GitHub Actions workflows to bootstrap one of the most aggressive worm campaigns in recent memory.

On November 24, 2025, at 4:11 AM UTC, malicious versions of multiple PostHog JavaScript SDKs including posthog-node, posthog-js, and posthog-react-native were published to npm containing a self-replicating worm dubbed Shai Hulud v2.

The attack has since expanded beyond npm into the Java/Maven ecosystem, with compromised artifacts discovered on Maven Central before being purged by security teams.

PostHog published a detailed post-mortem revealing that the attack originated not from compromised credentials but from the exploitation of a subtle vulnerability in their GitHub Actions workflow configuration.

On November 18, a now-deleted user opened a pull request that modified a script executed via the pull_request_target trigger, which runs workflows with the security context of the target repository rather than the potentially untrusted fork.

The malicious PR altered an auto-assignment script to exfiltrate a bot Personal Access Token with broad write permissions across PostHog’s GitHub organization.

Within one minute, the PR was opened, the workflow executed, and the PR closed and deleted.

Shai Hulud v2 abuses build systems

Days later, on November 23, the attacker validated the stolen credentials and pushed a detached commit that modified a lint workflow to harvest all GitHub secrets, including PostHog’s npm package publishing token.

The attack exploited a dangerous misconception among developers: that pull_request_target ensures code execution occurs from the target branch.

In reality, while the workflow definition comes from the target, the code being executed in this case, a JavaScript file checked out from the PR’s head was entirely controlled by the attacker.

Static analysis tools flagged the vulnerable workflow before merge, but engineers dismissed the alert believing their implementation was safe.

The malicious npm packages employ a two-stage loader system. A preinstall script silently downloads the Bun runtime and executes a 10MB obfuscated payload that performs aggressive credential harvesting across multiple vectors.

Scanning environments for tokens, enumerating AWS Secrets Manager across all regions, extracting secrets from GCP and Azure, and running TruffleHog against entire home directories to find hardcoded credentials.

The malware attempts privilege escalation through Docker-based sudoers manipulation, grants itself passwordless root access, and manipulates DNS and firewall rules to enable man-in-the-middle attacks.

Malware leverages workflow misconfigurations

All exfiltrated data environment variables, cloud secrets, and GitHub Actions credentials is triple-base64 encoded to evade detection and uploaded to randomly-named repositories in victims’ accounts marked with the campaign signature “Sha1-Hulud: The Second Coming.”

The worm propagates by validating stolen npm tokens, fetching up to 100 packages per maintainer, and publishing malicious patch versions with injected payloads.

It performs automated credential scraping on GitHub Actions metadata, searching for any string starting with “npm_” to bootstrap additional compromises.

If no valid tokens are found, the payload executes destructive file-shredding operations across user directories.

PostHog responded within hours, revoking tokens by 9:30 AM UTC and publishing known-good versions.

The company has since implemented sweeping security reforms: migrating to npm’s trusted publisher model, requiring security team review for any workflow changes, adopting pnpm 10 with install script protections, and restructuring secrets management.

Security researchers recommend immediate action: check for malicious repositories in GitHub accounts, rotate all credentials that may have been exposed, pin dependencies to known-good versions, and implement minimumReleaseAge settings in package managers to create a buffer before adopting new releases.

The attack underscores how subtle CI/CD configuration choices can create paths from untrusted contributions to ecosystem-wide supply chain compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.