> Source: [sk184368](https://support.checkpoint.com/results/sk/sk184368)

# sk184368 - Check Point response to the Shai-hulud vulnerability

| Property | Value |
|----------|-------|
| Solution ID | sk184368 |
| Date Created | 2025-11-25 |
| Last Modified | 2025-11-25 |
| Technical Level | General |
| Products | Other |
| Versions | Not Version-Specific |

## Solution

### Attack description

Shai-Hulud is a self-replicating npm supply-chain worm delivered via malicious package versions.  

* The worm runs post-install scripts on developer machines and CI runners to steal Git, npm, and cloud credentials.
* Using those credentials, It plants malicious GitHub workflows and exfiltrate the stolen credentials.
* It republishes trojanized npm packages from compromised maintainer accounts, spreading automatically.
* Impact: Source-code tampering, stolen secrets, poisoned builds, and potential cloud account compromise. If exfiltration fails, the worm deletes all writable files in the user's home directory.

### Protections in Check Point products

* **Quantum Security Gateway**: Blocks malicious npm/C2 traffic with Anti-Bot prevents outbound connections to Shai-Hulud domains, webhooks, and rogue Git endpoints.
* **Harmony Endpoint**: Detects malicious Node.js scripts and token stealers via anti-malware and behavioral analysis. Anti-Bot protection name: Worm.JS.Shai-Hulud.A.
* **ThreatCloud AI**: Updates IoCs for Shai-Hulud packages, domains, IPs, and hashes daily. Threat Emulation blocks malware before execution. Protection name: Trojan.Wins.Generic.tajai.ILW.

### Security recommendations

1. Enforce strong identity and MFA for all access to Git hosting, CI/CD platforms, npm registries and cloud consoles.
2. Replace long-lived PATs and static cloud keys with scoped, short-lived and OIDC-issued credentials wherever possible.
3. Restrict who can publish npm packages or modify CI workflows; protect main branches with mandatory reviews.
4. Require pinned versions and lockfiles for npm dependencies; quickly remove or upgrade any affected packages.
5. Run builds on hardened, ephemeral CI runners with minimal secrets present in the environment.
6. Monitor for unusual npm install behavior, new shai-hulud branches/workflows and unexpected secret-scanning tools in pipelines.
7. Protect your SCM (Source code management) system (e.g., GitHub) and internal package registry with IP allow list.
8. If you suspect exposure, rotate all Git, npm, and cloud credentials immediately. Then rebuild critical artifacts from a clean dependency tree.  
   **Warning**: Rotating credentials may disrupt automated workflows. Prepare fallback tokens and validate CI/CD jobs before rotation.

### Indicators of Compromise (IOCs)

SHA1 hashes of malicious npm packages:  

* d1829b4708126dcc7bea7437c04d1f10eacd4a16
* 3d7570d14d34b0ba137d502f042b27b0f37a59fa
* d60ec97eea19fffb4809bc35b91033b52490ca11
Use sha1sum \<filename\> or npm audit to verify integrity.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content