TLDR Tech / InfoSec
IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner: Inside the New Shai-Hulud npm Worm
A new Shai-Hulud variant has hit 42 @tanstack/* packages via a pull_request_target "Pwn Request" plus GitHub Actions cache poisoning and runtime OIDC token extraction from the Runner.Worker process, then harvested AWS, GCP, Kubernetes, Vault, GitHub, and SSH credentials on every install host. The worm uses GitHub's commit search index as a peer-to-peer bulletin board — infected hosts find each other's stolen tokens by querying for the literal sigil string — and plants a gh-token-monitor dead-man's switch that triggers destructive actions if the token is revoked before the persistence units are removed. Defenders should remove persistence (launchd/systemd units, Claude Code SessionStart hooks, VS Code tasks.json with runOn: folderOpen) before rotating tokens, block egress to api.masscan.cloud and the Session seed nodes, and hunt for .github/workflows/*.yml files.
Read the full story