Another round of the Shai-Halud campaign has surfaced, this time inside CrowdStrike’s npm packages. The same malware that first appeared in the tinycolor compromise is back, moving through the open-source ecosystem with a familiar playbook.
What happened
Attackers injected a malicious bundle.js file into several packages. When installed, the script runs TruffleHog to scan systems for API tokens and cloud credentials. Any valid keys are then used to set up unauthorised GitHub Actions workflows, giving attackers persistence inside developer environments.
Alert showing malicious bundle.js inside a compromised CrowdStrike package.
The npm registry removed the compromised versions quickly, but the campaign is ongoing.
Researchers are already tying it to other poisoned packages spreading under different publishers.
Packages affected
The following CrowdStrike packages were confirmed as compromised:
- @crowdstrike/commitlint 8.1.1, 8.1.2
- @crowdstrike/falcon-shoelace 0.4.2
- @crowdstrike/foundry-js 0.19.2
- @crowdstrike/glide-core 0.34.2, 0.34.3
- @crowdstrike/logscale-dashboard 1.205.2
- @crowdstrike/logscale-file-editor 1.205.2
- @crowdstrike/logscale-parser-edit 1.205.1, 1.205.2
- @crowdstrike/logscale-search 1.205.2
- @crowdstrike/tailwind-toucan-base 5.0.2
The payload was tied to a single file, identified with SHA-256 hash 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09.
Why it matters
This is the same campaign that hijacked tinycolor and dozens of other npm libraries
Once a compromised package is installed, it spreads by stealing npm tokens and GitHub credentials, publishing the malware further and pulling more projects into the chain.
For development teams, that means supply chain risks won’t stop with one vendor. It moves with every dependency.
What to do now
- Remove the compromised packages or revert to trusted versions.
- Rotate all npm tokens, API keys, and credentials from affected systems.
- Audit CI/CD pipelines and developer machines for rogue workflows or suspicious publish events.
- Keep logs under close watch for any signs of modification.
CrowdStrike confirmed the poisoned packages were removed quickly and stressed they were unrelated to Falcon. Customers using Falcon are not impacted.
What we think
The Shai-Halud campaign is moving through the supply chain by targeting the smallest pieces of code. A dependency update is all it takes to place malware inside production systems. The same payload has now been recycled across multiple publishers, multiplying its reach.
The concern is not a single poisoned package. It’s the speed of replication and the lack of visibility once trust is broken.
Gridware’s is tracking the spread and watching which industries face the highest risk if this pattern continues.
