Your Code Editor Is The New Trojan Horse

Shai-Hulud, a self-replicating menace, previously dominated the npm ecosystem. Developers installing its poisoned packages inadvertently triggered scans, stealing critical credentials like npm tokens, GitHub tokens, AWS, GCP, And Azure keys. These stolen tokens then facilitated automatic propagation, publishing compromised versions of the victim’s own npm packages.

This insidious threat, first seen in September 2025 and returning larger in November (affecting over 500 packages and 700 versions), has now profoundly escalated. A new wave, flagged by Socket.dev, shows Shai-Hulud breaching the Go ecosystem, specifically the Verana Blockchain project. This marks a dangerous jump beyond traditional JavaScript environments.

Crucially, this is not a Go vulnerability; the attack circumvents Go’s build process entirely. Instead, it embeds malicious JavaScript files within the Go module’s source archive, targeting the developer’s tools. Persistence is established via `.claude` and `.vscode` folders, with a `settings.json` file containing a Claude Code SessionStart hook and a `tasks.json` file including a VS Code folder open task executing `node .claude/setup.mjs`. The malware thus fires the moment a developer opens the project or initiates a coding session, transforming the editor into a potent new attack vector.

The Shai-Hulud worm has evolved, abandoning its reliance on package registries to directly target your developer environment. This sophisticated new vector plants malicious hooks within critical configuration files like .vscode/tasks.json and .claude/settings.json, turning your trusted editor into a direct threat.

This design ensures the malware activates the instant a project folder opens or a Claude Code session begins, bypassing traditional defenses entirely. The `npm install --ignore-scripts` flag, previously a critical safeguard, now offers no protection whatsoever, as no package installation is necessary to trigger the payload.

Once active, the malware leverages Bun to decode its next stage, executing a precise credential theft operation. It systematically raids your system, targeting .env files and other accessible locations for sensitive data, including GitHub tokens, AWS, GCP, And Azure keys.

Before exfiltrating this trove of data, the worm intelligently probes for active security software, detecting solutions like CrowdStrike, Defender, And SentinelOne. This reconnaissance phase ensures maximum stealth, allowing it to bypass your enterprise's established security perimeters and transmit stolen assets undetected.

The battlefield has fundamentally shifted. Your enterprise can no longer limit its security posture to auditing `node_modules` and package dependencies. The new Shai-Hulud variant, detected in Go modules by Socket.dev, demonstrates a profound paradigm shift: the attack surface now encompasses the entire development environment, specifically project-level configurations like `.vscode/tasks.json` and `.claude/settings.json`. This demands a comprehensive scrutiny of every file within a cloned repository, not just its declared dependencies.

Consequently, conventional remediation steps are now entirely ineffective. `npm uninstall` offers no defense when the malicious code resides not in a manageable package, but directly within configuration files designed for editor automation. The worm's persistence mechanism bypasses traditional dependency management, allowing it to execute code the moment a folder is opened or a coding session begins, without ever touching an install script.

This presents an acute downstream risk. An infected developer, unaware of the compromised `.vscode` or `.claude` files, could unknowingly commit this malicious code into the shared codebase. This pushes the attack into your CI/CD pipelines, potentially compromising production environments and critical infrastructure. Understanding this evolving threat is crucial for leaders; for more context on the worm's history, read Shai-Hulud npm Supply Chain Attack: What You Need to Know.

Protecting your local environment requires a fundamental shift in perception. Treat your IDE and AI-assistant configurations—specifically files within `.vscode` and `.claude` folders—as executable code. Before opening any new project, manually inspect these critical directories. This proactive scrutiny prevents malicious hooks, like those used by Shai-Hulud, from executing upon folder open or session start, safeguarding your machine from immediate compromise.

Crucially, disable automatic task execution in VS Code. Navigate to the "Task: Manage Automatic Tasks" command and ensure this feature is off. This setting prevents any potentially malicious 'folder open' tasks from running without your explicit consent, adding a vital layer of defense against surreptitious code execution.

Beyond local safeguards, implement robust defense-in-depth strategies. Employ short-lived, least-privileged tokens leveraging OIDC for all services like GitHub, AWS, and Azure. This significantly limits the value of any stolen credentials. Furthermore, impose strict egress filtering on your CI runners, such as GitHub workflows, to block unauthorized data exfiltration attempts, ensuring that even if an attack penetrates, sensitive data cannot leave your controlled environment.

What is the Shai-Hulud worm?

Shai-Hulud is a self-replicating worm that infects software packages. It steals developer credentials like npm tokens, cloud keys, and SSH keys to poison more packages and spread automatically.

How has this new supply chain attack changed?

Instead of using package install scripts, the new wave embeds malicious code in project configuration files like `.vscode/tasks.json` and `.claude/settings.json`. This code executes when a developer opens the project in their editor, bypassing common defenses.

Why doesn't the 'npm install --ignore-scripts' flag work against this attack?

The `--ignore-scripts` flag only prevents scripts from running during package installation. This attack vector doesn't use install scripts; it triggers via editor actions like opening a folder or starting a coding session, making that flag ineffective.

What is the most critical action developers can take to stay safe?

Treat your developer environment configurations as executable code. Always inspect files like `tasks.json` in cloned repositories before opening the project, and disable automatic task execution in your editor's settings.