24JUL

Attack worm kit now open-sourced freely

4 min read

18:20UTC

UNC6780 released its Shai-Hulud repository-poisoning worm as open-source under an MIT licence, turning a bespoke operation into a kit anyone can run; a copycat used it to poison 5,561 repositories in six hours.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Shai-Hulud's open-source release commoditises supply-chain poisoning, and valid signatures no longer prove a package is safe.

The UNC6780 supply-chain toolkit has been franchised. Shai-Hulud 3.0 was released as open-source under an MIT licence on 12 May with a $1,000 Monero bounty for the largest attack built on it, turning a bespoke operation into a kit anyone can download ¹. UNC6780 (also tracked as TeamPCP) is the financially-motivated cluster that cloned 300-plus Cisco repositories via stolen credentials and roughly 3,800 of GitHub's own internal repositories through a trojanised editor extension . UNC6780 has done this twice before; what is new on 12 May is the technique leaving the originator's hands. A copycat campaign tracked as Megalodon used the kit to poison 5,561 GitHub Actions repositories in six hours, with around 5,718 malicious commits ².

A variant tracked as Phantom Gyp, observed on 3 June, runs where defenders are not yet looking. It weaponises the binding.gyp native-build file so malicious code runs during npm (the Node package manager, JavaScript's standard dependency tool) install through Node's compiler step. That slips past the preinstall and postinstall hook monitors most software-composition tools watch, the same developer-toolchain surface that the SAP npm, OpenVSX and PyPI compromises first opened .

Worse for the trust model: researchers confirmed valid SLSA provenance attestations (cryptographic signatures proving where a package was built) on malicious packages ³. The signature proves origin without proving the code is clean, so attestation alone is not a control. A defender who treats a valid provenance stamp as a safety guarantee is reading the wrong signal. The shift here is economic as much as technical: poisoning thousands of projects no longer needs a sophisticated operator, only stolen credentials and an evening.

Deep Analysis

In plain English

Software developers rely on shared code libraries, called packages, to build applications quickly. Most developers install packages via automated tools, trusting that the packages are safe. Supply-chain attacks poison those packages with hidden malicious code so that when a developer installs a package, their computer also runs the attacker's code without knowing it. A criminal group called UNC6780 released a tool kit called Shai-Hulud that automates these attacks, and published it publicly in May 2026, offering a $1,000 prize to whoever used it to run the biggest attack. One copycat used the kit to poison 5,561 code repositories on GitHub in six hours. A second variant called Phantom Gyp found a way to sneak past the security checks npm, the most popular package installer, uses to catch malicious code. Security researchers also confirmed that a widely used security certificate system called SLSA gave legitimate-looking certificates to some of the poisoned packages, because SLSA only proves where a package was built, not whether the code inside it was safe.

Deep Analysis

Root Causes

The binding.gyp evasion in Phantom Gyp exploits a specific gap in npm's security model: npm's hook-monitor systems scrutinise preinstall and postinstall script fields in package.json for malicious commands, but the native build step invoked via binding.gyp runs through Node.js's node-gyp compiler infrastructure rather than the npm lifecycle hooks.

Node-gyp was designed to compile C/C++ native extensions legitimately; it predates modern supply-chain security thinking and its execution is not surfaced as a lifecycle event to npm audit tooling.

The SLSA provenance confirmation on malicious packages exposes a conceptual gap in how the supply-chain security community communicated SLSA's guarantees. SLSA Level 2 and 3 attestations prove that a package was built from a specific commit in a specific repository by a specific build system; they do not attest that the commit itself contained safe code.

UNC6780 exploited this gap by building packages from legitimate-looking repositories that contained poisoned dependency declarations, generating valid SLSA attestations on packages that delivered malicious payloads at runtime.

UNC6780's decision to open-source Shai-Hulud under an MIT licence reflects a threat-actor business model shift: the group has moved from conducting targeted supply-chain breaches (the Cisco repository clone via SANDCLOCK credentials, ) to operating as a supply-chain attack platform provider, collecting intelligence on which techniques produce the largest real-world campaigns without conducting those campaigns directly.

Escalation

Elevated and accelerating. The open-source release of Shai-Hulud converts repository poisoning into a commodity attack. The Phantom Gyp binding.gyp evasion, observed 3 June, adds a concrete mechanism that bypasses current npm hook-monitoring defences without a published fix from npm.

What could happen next?

Risk
npm's preinstall/postinstall hook-monitoring does not cover the binding.gyp native build path, leaving packages with native extensions as an unmonitored attack surface until npm ships a fix.
Immediate · Assessed
Consequence
SLSA provenance attestations confirmed on malicious packages will likely trigger a revision of how SLSA Level 2 and 3 guarantees are communicated in developer-security guidance from OpenSSF and CISA.
Short term · Reported
Precedent
The Monero bounty model for the largest attack built on an open-sourced framework may signal a new class of threat actor that monetises technique publication rather than direct attack execution.
Medium term · Reported

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Kaseya VSA supply-chain attack provides the closest structural precedent for a tool being released into the criminal ecosystem and immediately generating copycat campaigns. In that case, the REvil group used Kaseya VSA's trusted update mechanism to push ransomware to roughly 1,500 managed-service-provider customers simultaneously.

Shai-Hulud's open-source release is an escalation of the same structural pattern: instead of one attack via one vendor's update channel, it provides an automated framework any attacker can run against any package registry. The bonusing model (a Monero bounty for the largest attack) is novel; Kaseya was a closed criminal operation.

Counter-parallel: The 2020 SolarWinds SUNBURST implant demonstrates that the most damaging supply-chain attacks in recent history have not been open-source kit campaigns but precision operations by a single threat actor maintaining operational security over months.

SUNBURST reached approximately 18,000 organisations but the actual post-compromise activity was limited to roughly 100 high-value targets. The Shai-Hulud commoditisation model produces wider reach but lower per-victim dwell quality, as indiscriminate campaigns generate faster detection signals.

Consensus view: Sonatype's Supply Chain Security team and Google's OpenSSF (Open Source Security Foundation) both assess the Shai-Hulud open-source release as the most significant commoditisation event in developer-toolchain supply-chain attacks since the 2020 SolarWinds SUNBURST implant.

Their core argument is mechanistic: by publishing under an MIT licence with a $1,000 Monero bounty for the largest attack, UNC6780 converted repository poisoning from a technique requiring operational security expertise into a competitive open-source project, compressing the entry barrier to near zero. The Megalodon copycat campaign poisoning 5,561 GitHub Actions repositories in six hours on 18 May validated this assessment empirically.

Counter-view: OX Security's analysts caution that the Megalodon operation's scale (5,561 repositories, roughly 5,718 malicious commits) exaggerates the delivered payload risk because GitHub Actions repositories vary enormously in active usage; a repository with zero CI/CD runs is not an active supply-chain attack surface.

Protos Labs' own data shows the Megalodon campaign hit a large number of archived and low-activity repositories, and OX Security estimates the genuinely active blast radius was smaller by one to two orders of magnitude. The Open Policy Agent (OPA) Project in Beijing further notes that SLSA attestation confirmation on malicious packages does not prove SLSA is broken; it confirms that SLSA attests build provenance, not code content, and that conflating the two is a misunderstanding of the attestation model's scope.

Key tension: Whether the Phantom Gyp binding.gyp evasion (observed 3 June) represents a fundamental break in npm's hook-monitor security model, or whether the fix is straightforward: reject native build files from packages that did not declare them in their published manifest, a control that npm could implement without breaking legitimate native extensions .

Sources:Protos Labs

Mentions:Shai-Hulud →Phantom Gyp →GitHub →Protos Labs →Aqua Security →OpenVSX →PyPI →Beijing →Google →Cisco →SolarWinds →UNC6780 →Axios npm package →

First Reported In

Update #7 · VPN zero-day, no-patch KEV, late Exchange

Protos Labs· 14 Jun 2026

Read original →

Causes and effects

Caused by

GitHub's own code cloned via add-on

UNC6780's GitHub repository breach via the poisoned Nx Console extension established the supply-chain arc; the Shai-Hulud open-source release and Phantom Gyp variant are the next escalation of the same threat cluster's capability.

Occurred 18 May 2026

Read story →

UNC6780 takes Cisco AI Defense source code

UNC6780's 300-plus Cisco repository clone via SANDCLOCK credentials is the prior operation in the same cluster's arc; the Shai-Hulud open-source release commoditises the techniques developed in that campaign.

Occurred 11 May 2026

Read story →

Three supply-chain hits in thirteen days

The TeamPCP SAP npm and PyPI supply-chain attacks established the developer-toolchain attack surface; Shai-Hulud's open-source release and Phantom Gyp turn that surface into a commodity kit.

Occurred 29 Apr 2026

Read story →

UNC1069 planted WAVESHAPER.V2 in Axios via maintainer phishing

UNC1069's WAVESHAPER.V2 plant in the Axios npm library is the same actor arc of targeting widely-used developer toolchain packages; the Shai-Hulud framework and Phantom Gyp extend that technique.

Occurred 5 May 2026

Read story →

This Event

Attack worm kit now open-sourced freely

Industrial-scale supply-chain attack capability is now commoditised, and a new evasion runs where most scanners do not watch.

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.