Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft

A new npm supply-chain campaign dubbed Sha1-Hulud trojanized hundreds of npm packages uploaded between Nov 21–23, 2025, and has been observed by multiple vendors; Wiz reported over 25,000 affected repositories across ~350 users with ~1,000 new repos appearing every 30 minutes. The malware executes during preinstall (setup_bun.js → bun_environment.js), installs or finds Bun, registers infected machines as self-hosted GitHub runners named "SHA1HULUD," injects a malicious workflow to exfiltrate GitHub secrets into actionsSecrets.json and runs TruffleHog to steal NPM tokens and cloud credentials; it can also escalate to root via a Docker-mounted privileged container and includes conditional wiper logic that destroys user home directories if exfiltration fails. Firms should treat this as a high operational-risk event for development and CI/CD systems—scan endpoints for impacted packages, remove compromised versions, rotate credentials, and audit .github/workflows for persistence artifacts.

Analysis

Market structure: Expect outsized near-term demand for endpoint and supply-chain scanning tools, identity/IAM hardening, and CI/CD secrets managers, which should allow market leaders to accelerate bookings by ~5–15% over the next 3–12 months versus peers. Smaller DevOps tooling vendors that monetize developer trust (hosted CI, public package-scanning marketplaces) face client churn risk and pricing pressure as enterprise buyers pay to insulate pipelines.

Risk assessment: Tail scenarios include a regulatory push (mandatory software SBOMs, fines) or a widespread cloud-credential theft wave that forces multi-week dev stoppages — either could knock 5–20% off affected vendors’ near-term revenue. Hidden dependencies: orgs that rely on public registries and GitHub Actions are single points of failure; contagion accelerants include automated scanner alerts and coordinated exploit disclosures within 72 hours.

Trade implications: Tactical long exposure to high-quality cybersecurity vendors and cloud IAM is favored over broad developer-tool stalls; use concentrated 3–6 month option structures to capture volatility while limiting capital. Simultaneously, underweight small/mid-cap DevOps vendors with significant hosted CI exposure and rotate 2–4% into cash/Treasuries as a liquidity hedge until remediation metrics (percent of repos flagged, number of confirmed secret exfiltrations) drop below enterprise thresholds.

Contrarian angles: The market may underprice multi-year secular upside for supply-chain security vendors after an initial knee-jerk selloff — historical analog (SolarWinds) shows multi-year re-rating of endpoint/cloud defenders. Risk: overpaying for expected uptake could produce a post-earnings pullback; prefer buy-on-dip discipline tied to clear pipeline conversion metrics.

Key Decisions for Investors

• Establish a 2–3% portfolio long split: 1–1.5% CrowdStrike (CRWD) and 1–1.5% Palo Alto Networks (PANW); target 10–15% upside in 3–6 months as emergency security spend reaccelerates; exit/trim if combined YoY ARR growth guidance fails to rise by >=3% at next report.
• Buy 3–6 month call spreads (debit) on CRWD and PANW sized 0.5–1% total capital each (buy ATM, sell +12–18% strike) to lever expected short-term volatility while capping premium outlay.
• Initiate a pair trade: long Zscaler (ZS) 1.5% vs short GitLab (GTLB) 0.75% to express preference for pure-play cloud security over CI/CD-centric exposure; size stops at 10% adverse move and review after 60 days or after one earnings release.
• Increase cash/liquidity by 2% and allocate to 1–3yr Treasury ETF (SHY) as a hedge; if verified credential exfiltration events linked to package compromises exceed 100k repositories flagged or one major cloud provider reports material customer breach, increase hedge to 5%.