Malicious NuGet and npm Packages Target Banking and Cloud Secrets

Recent security investigations have uncovered two distinct supply chain attacks targeting developers: a malicious NuGet package masquerading as a Sicoob software development kit and a sophisticated npm worm dubbed “Shai-Hulud” [1, 3]. These campaigns highlight a growing trend of attackers compromising open-source ecosystems to harvest sensitive banking credentials, cloud tokens, and private source code [1, 2, 3].

Key takeaways

• A malicious NuGet package disguised as a Sicoob SDK exfiltrated banking credentials and PFX certificates to a third-party telemetry endpoint [3].
• The “Shai-Hulud” npm worm automatically injects malicious code into packages maintained by compromised developer accounts to spread itself [1].
• The npm malware targets GitHub, AWS, and GCP tokens, and has been linked to the previous s1ngularity supply chain attack [1].
• Security vendors recommend that any users who installed compromised packages assume their secrets have been exfiltrated and rotate all affected credentials [1].

The Sicoob NuGet SDK Compromise

In early May 2026, a malicious package appeared on the NuGet repository under the name “Sicoob. Sdk,” claiming to provide a .NET 8 SDK for developers integrating with Brazil’s Sicoob banking APIs [3]. While the package appeared legitimate, it contained hidden functionality designed to harvest authentication data during normal application execution [3]. When a developer used the SDK, the malicious code read PFX certificate files—which contain both certificates and private keys—from the disk and transmitted them, along with plaintext passwords and client IDs, to a third-party Sentry endpoint [3]. By leveraging this trusted error-monitoring platform, the attackers were able to blend the stolen data with standard application telemetry, effectively evading detection [3]. In some instances, the exfiltrated data included financial transaction details and payer information [3].

The Shai-Hulud npm Worm

Simultaneously, researchers identified a self-propagating npm worm named “Shai-Hulud,” which targets cloud environments by compromising developer accounts [1]. Once an account is breached, the worm identifies other packages maintained by that developer and injects a malicious bundle.js file into them via a post-install action [1]. This script is designed to steal tokens for GitHub, AWS, and GCP, and utilizes the open-source tool TruffleHog to scan for up to 800 types of secrets [1]. The worm also creates public GitHub repositories to dump stolen secrets and pushes new GitHub Actions workflows to exfiltrate environment tokens to a remote server [1]. Furthermore, the malware attempts to migrate private GitHub repositories to public status, potentially exposing source code for further vulnerability analysis [1]. ReversingLabs reported that at least 700 GitHub repositories have been impacted by this campaign [1].