Dead Man’s Switch: A Massive npm Supply Chain Attack That Puts Developer Data at Risk

A major security incident has shaken the JavaScript and open-source ecosystem. GitLab’s Vulnerability Research team recently uncovered a large-scale supply chain attack targeting the npm package ecosystem  one of the most widely used software repositories in the world.

This attack doesn’t just steal sensitive information. It carries something far more dangerous:
a built-in “Dead Man’s Switch” designed to destroy user data if the attackers lose control.
Below is a complete report explaining what happened, how the malware works, who is affected, indicators of compromise, and what organizations must do now.


1. Overview of the Attack

The attack involves a dangerous and evolved malware variant known as Shai-Hulud.
Attackers uploaded malicious npm packages that look legitimate on the surface. When a developer installs one of these packages, the malware silently activates and begins its multi-stage attack.

The result is a widespread, self-spreading infection that compromises developer machines, steals credentials, repackages legitimate npm libraries, and republishes them automatically — turning victims into further carriers of the malware.

This is one of the largest and most destructive npm supply-chain attacks ever discovered.
 

2. How the Attack Works (Step-by-Step)

Step 1 — Malicious npm packages are published

The attackers add harmful code inside common npm packages.
These packages appear harmless and install normally.
 

Step 2 — A hidden script runs on installation

As soon as a developer installs the affected package, a preinstall script executes automatically.

This script downloads what appears to be a legitimate Bun JavaScript runtime, but the file is actually a 10 MB obfuscated malware payload.

Step 3 — The malware steals credentials

Once active, the malware aggressively searches the system for highly sensitive information, including:

* GitHub personal access tokens
* npm authentication tokens
* AWS, GCP, and Azure cloud credentials
* Secrets and passwords stored in config files
* SSH keys and other authentication data

To boost its scanning power, the malware even downloads TruffleHog, a legitimate security tool, and uses it to find hidden API keys across the entire home directory.

Step 4 — Using stolen tokens to spread further

With the stolen credentials, the malware:

* Logs in to the victim’s npm account
* Infects all packages maintained by the victim
* Injects malicious scripts into `package.json`
* Increases the version number
* Republishes the compromised packages to npm

This creates a worm-like propagation mechanism.
Each infected developer unknowingly spreads the malware to thousands more.

Step 5 — Data Exfiltration

All captured credentials are uploaded to attacker-controlled GitHub repositories labeled with names like:
 

“Shai-Hulud: The Second Coming”

These repositories act as both a storage system and a coordination hub between infected machines.
 

Step 6 — The “Dead Man’s Switch” destructive feature

This is the most alarming part.

If the infected device loses access to both GitHub and npm — such as:

* GitHub suspending malicious repos
* npm revoking compromised tokens
* Network blocks
* Internet outages

…the malware triggers immediate data destruction, assuming defenders are trying to shut it down.
 

Destructive behavior:

* Windows: deletes user files and overwrites disk sectors
* Linux/macOS: uses secure wiping commands to irreversibly destroy data

This mechanism raises the overall risk dramatically.


3. Why This Attack Is Extremely Dangerous

This threat stands out because it combines:
 

✔ Supply-chain compromise
Attack spreads through legitimate npm libraries.

✔ Credential harvesting
Stolen GitHub, npm, and cloud tokens give attackers long-term access.

✔ Worm-like self-propagation
Each victim becomes a new source of infection.

✔ Destructive payload
A unique “Dead Man’s Switch” can wipe data globally.

✔ Trusted ecosystem abuse
npm is deeply integrated into developer workflows, CI/CD pipelines, and production systems.

The combination makes this attack one of the most severe in the recent history of open-source security.

4. Indicators of Compromise (IOCs)

Organizations should immediately check for the following red flags:

Suspicious Files

* `setup_bun.js`
* `bun_environment.js`
* Obfuscated JavaScript files appearing unexpectedly
 

Malicious GitHub Workflows

* `.github/workflows/shai-hulud-workflow.yml`
 

Unusual npm Activity

* Packages updated without your action
* Version numbers increased unexpectedly
* Unrecognized preinstall or postinstall scripts
Suspicious GitHub Events

* PATs used from unknown locations
* Sudden repo modifications
* New public repos containing stolen tokens

Unexpected network behavior

* Outbound traffic to unknown GitHub repos
* Scripts accessing cloud credential files

If any of these are present, treat the system as compromised.
 

 

5. Attribution — Who Is Behind the Attack?

At this time, no official hacker group has been identified or named.

* No APT groups have claimed responsibility
* No known cybercriminal syndicate has been linked
* The sophistication suggests a highly skilled actor

While some similarities exist with previous npm compromises, no confirmed attribution has been published by security researchers.

6. Recommended Actions & Mitigation Steps

Every developer and organization should take the following steps immediately:
 

1. Audit all npm dependencies
Check for unexpected updates or unfamiliar packages.

2. Rotate all credentials
This includes GitHub PATs, npm tokens, and cloud credentials.

3. Review GitHub workflows
Remove any that you did not create.
 

4. Disable automatic updates in CI/CD
Never allow pipelines to install newer package versions without review.
 

5. Scan all systems for IOCs
Look for malicious files, modified packages, and suspicious installation scripts.
 

6. Enable dependency scanning tools
GitLab, GitHub, and other platforms offer automated scanning features.
 

7. Rebuild systems if needed
If a destructive module is suspected, treat the system as a critical incident.

7. Conclusion

The Dead Man’s Switch npm attack is a major wake-up call for the entire open-source community.
By combining malware delivery, credential theft, self-replication, and destructive capabilities, it demonstrates how fragile and interconnected our software supply chains have become.

Any organization using npm  from small teams to major enterprises  must take this threat seriously.
Immediate auditing, monitoring, and security hardening are essential to prevent long-term compromise.

Supply-chain security is no longer optional.
This attack proves that a single compromised package can lead to ecosystem-wide chaos.

If you need a PDF report, a CVE-style advisory, or a simplified version for non-technical readers, I can prepare that too.