Shai-Hulud 2.0 Checker

Detect malicious npm packages linked to the Shai-Hulud 2.0 supply chain attack. This tool scans your package-lock.json against Wiz Security's IOC database of ~700 compromised packages that execute credential theft and secret exfiltration during installation.

About the Attack

The Shai-Hulud 2.0 campaign (November 2025) compromised major packages including:

• Zapier packages
• ENS Domains packages
• PostHog packages
• Postman packages
• AsyncAPI packages

The malware:

• Executes during preinstall phase
• Steals AWS, Azure, and GCP credentials
• Exfiltrates GitHub tokens and SSH keys
• Creates backdoor workflows
• Targets both CI/CD pipelines and developer machines

Installation

Install globally:

npm install -g @oat-sa-private/shai-hulud-2-checker

Or install from GitHub:

git clone [email protected]:oat-sa/shai-hulud-2-checker.git
npm install
npm link

Usage

Run the checker in the current directory:

shai-hulud-2-checker

Or scan specific directories recursively:

# Scan a single folder and all its subfolders
shai-hulud-2-checker ~/work

# Scan multiple folders
shai-hulud-2-checker ~/work ~/projects ~/repos

The tool will:

1. Fetch the latest list of malicious packages from the Wiz Security IOC repository
2. Recursively find all package-lock.json files in the specified directories
3. Scan each project's dependencies
4. Report results per project with a summary

Note: The tool automatically skips node_modules, .git, and other common non-project directories for faster scanning.

Example Output

Scanning multiple projects:

Fetching malicious package list...
Loaded 700 suspicious packages signatures.

Scanning directories: /Users/you/work
Found 5 project(s) to scan.

📁 /Users/you/work/project-a
   ✅ Clean (245 dependencies scanned)

📁 /Users/you/work/project-b
   ⚠️  WARNING: 2 malicious package(s) detected!
      - @posthog/agent v1.24.1
      - posthog-node v5.11.3

📁 /Users/you/work/project-c
   ✅ Clean (89 dependencies scanned)

────────────────────────────────────────────────────────────

⚠️  SUMMARY: Found 2 malicious package(s) in 1 project(s).

Requirements

• Node.js >= 20.0.0 (with ES modules support)
• Projects should have package-lock.json files (lockfileVersion 3 recommended)

Data Source

This tool uses the malicious package list maintained by Wiz Security: https://github.com/wiz-sec-public/wiz-research-iocs

License

ISC