Look, the void-ulid alert is a red-flare moment. According to the @spchainattack report from supplychainattack.org dated June 9, this package should be treated as a full system compromise — any machine that installed it is considered fully breached, with attackers achieving unrestricted access. The report emphasizes that affected systems require immediate rotation of all secrets and cryptographic keys from unaffected machines, pointing to a payload capable of comprehensive credential extraction and potential persistence.
I do not have exact download counts or a complete transitive-dependency map for void-ulid. But here is what the blast radius math looks like: npm dependency graphs are wide. A single package pulled in even as a nested transitive dependency can reach thousands of downstream projects. In a typical Node CI/CD pipeline, if void-ulid made it into the node_modules tree during npm install, that build agent becomes a trust failure point immediately. That environment typically carries npm publish tokens, GitHub tokens, AWS and GCP keys, and often write access to artifact registries and container image repos. One install is enough to exfiltrate every secret present and poison any artifacts the pipeline publishes.
On malware capabilities, the broader Shai-Hulud Miasma wave that Security Boulevard tracked at 281 malicious package versions in early June exploits binding.gyp files to execute native code during npm install, bypassing detection of preinstall/postinstall scripts. The payload is a comprehensive infostealer that harvests system information, environment variables, and authentication tokens for npm, GitHub, AWS, and GCP. The leaked Shai-Hulud source code, which I previously flagged as having turned into a freely replicable malware framework after it leaked around May 13, also includes propagation logic where stolen maintainer credentials are used to publish malicious versions of legitimate packages — a worm-like cascade through the registry. The current OX Security and BleepingComputer reporting on copycat deployments notes the leaked kit exfiltrates to C2 domain 87e0bbc636999b[.]lhr[.]life. Campaign-level IOCs include unauthorized workflow injection files such as shai-hulud-workflow.yml in .github/workflows/ directories, and a malicious JS file with SHA256 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09.
Remediation is not npm uninstall and moving on — the install-time code already ran. Assume breach on every host, developer laptop, and container that installed this package. Rotate every secret present in the environment: npm tokens, GitHub PATs and app credentials, AWS/GCP/Azure keys, SSH keys, container registry passwords, and code-signing certificates. And this is the part teams miss — rotate them from clean machines. Do not generate new secrets on a potentially compromised build agent; if the attacker has a keylogger or web shell, you are just handing them the new keys. Then audit for persistence: inspect .github/workflows/, lockfiles, git hooks, and IDE configs for unauthorized modifications. If that CI pipeline published Docker images, npm packages, or binaries after the compromise, rebuild from known-clean source on fresh infrastructure and re-sign.
Is this the same actor or a copycat? This aligns with the structural trust failure I flagged on June 9. The leaked Shai-Hulud source transformed a single-actor campaign into a commodity malware kit. OX Security found TeamPCP copycats deploying non-obfuscated clones of the leaked code via typosquatting packages with 2,678 weekly downloads. Given that void-ulid appeared in this same window with the same full-compromise warning pattern, my read is that it represents another deployment from that leaked kit — whether by the original actors, affiliates, or independent copycats. The source code is freely circulating, which means new package names will keep appearing until registries close the root trust failures around maintainer credential exposure and install-time sandboxing.