Shai Hulud Supply Chain Attack Targets npm Packages and Claude Code Environments
Key Takeaways
- ▸Shai Hulud malware compromised 428+ npm packages across 1,700+ versions, starting with keyv and cacheable, two widely-used caching libraries
- ▸The attack specifically targets Claude Code environments by injecting malicious setup hooks into .claude/settings.json and .claude/setup.mjs, executing during session startup
- ▸The worm self-propagates using stolen npm credentials with bypass_2fa enabled, automatically patching and re-publishing every package the attacker can write to
Summary
JFrog's security research team has identified a sophisticated supply chain attack compromising over 428 npm packages across 1,700+ versions. The Shai Hulud malware campaign specifically targets development environments including Anthropic's Claude Code, beginning with compromises to popular caching libraries keyv and cacheable, then spreading by harvesting npm credentials with elevated permissions.
The malware payload implements multi-stage credential theft targeting local, CI, cloud, Kubernetes, and Vault secrets, alongside specialized attacks on GitHub credentials and Claude Code configuration files to establish persistence across developer environments. The worm self-propagates by automatically patching and re-publishing every package the attacker can access using stolen npm tokens.
The attack demonstrates an evolving threat model where supply chain compromises target the full development infrastructure stack, not just individual packages, representing a significant risk to AI development teams and their tooling ecosystems.
- npm 12+ users are protected as preinstall lifecycle hooks are disabled by default; users on earlier npm versions require immediate updates
- GitHub Actions and repository infrastructure are secondary attack vectors, with malware committing config files and harvesting organization secrets via stolen credentials
Editorial Opinion
This campaign represents a significant evolution in supply chain attacks: it's not just stealing credentials but weaponizing development environments end-to-end across the full infrastructure stack. The fact that it specifically targets Claude Code alongside npm and GitHub shows attackers now view AI development infrastructure as a high-value target. Organizations using Claude Code should treat this as urgent and verify their environments immediately, while the broader lesson is clear: development credentials—especially npm tokens with 2FA bypass enabled—are now critical security perimeters that demand the strongest protections.
