The Shai-Hulud worm has spread beyond the npm ecosystem and was discovered in Maven . Socket specialists noticed an infected package on Maven Central containing the same malicious components used in the second wave of Shai-Hulud attacks.
Experts have identified the org.mvnpm:posthog-node:4.18.1 package on Maven Central, which contains two components characteristic of Shai-Hulud: the setup_bun.js loader and the main payload bun_environment.js. Currently, this is the only Java package found containing this malware.
“The PostHog project was compromised in both the JavaScript/npm and Java/Maven ecosystems, with the same payload, Shai-Hulud v2, being used in all cases,” the researchers write.
It’s important to note that the PostHog team does not publish the package on Maven Central. The org.mvnpm coordinates are automatically generated by the mvnpm process, which reconstructs NPM packages into Maven artifacts.
Maven Central representatives have already announced that they are working on additional security measures to prevent the repackaging of compromised npm components.
Recall that the second wave of Shai-Hulud attacks, which began last week, is targeting developers worldwide, with the attackers’ goal of stealing data. The new version of the worm has become more stealthy , allowing attackers to gain unauthorized access to the accounts of npm maintainers and release versions of infected packages under their names.
According to analysts at Wiz , as of November 24, 2025, more than 25,000 GitHub repositories had published stolen secrets from victims, with approximately 1,000 new repositories appearing every 30 minutes.
A technical analysis of the malware performed by Step Security specialists revealed that the malware consists of two files: setup_bun.js (a dropper disguised as a Bun installer) and bun_environment.js (10 MB), which uses complex obfuscation techniques: a hexadecimal-encoded string with thousands of entries, a separate loop for anti-parsing, and an obfuscated function to extract each line of code.
Once infected, the malware performs a five-stage attack, which includes stealing secrets (GitHub and npm tokens, AWS, GCP, Azure credentials) and destructively overwriting the victim’s entire home directory if four necessary conditions are not met: If the malware fails to authenticate to GitHub, it creates a repository and finds the GitHub and npm tokens.
Eventually, the stolen secrets are published in automatically generated GitHub repositories with the description “Sha1-Hulud: The Second Coming”.
As reported by analysts at Aikido Security , attackers exploited incorrect CI settings in the GitHub Actions workflow. Specifically, the attackers exploited vulnerabilities in the pull_request_target and workflow_run triggers, allowing them to compromise the AsyncAPI, Postman, and PostHog projects.
According to researchers at GitGuardian , OX Security , and Wiz, this malicious campaign leaked hundreds of GitHub access tokens and credentials for AWS, Google Cloud, and Azure (over 5,000 files with stolen secrets were uploaded to GitHub). An analysis of 4,645 repositories identified 11,858 unique secrets, of which 2,298 were still valid and publicly accessible as of November 24, 2025.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
