Hey, I'm Ionut Cristian Florescu, a maintainer who got hit, along with my community, by this exact worm in early June 2026. I'm deliberately raising an issue here instead of reporting the repo. A report mostly results in the repository being disabled, which punishes you, the owner, rather than solving anything. I learned that the hard way. Cleaning it up yourself is the better path.
A read-only sweep of public repos still finds the payload on one or more branches here. This might be a false positive, or you may already be mid-cleanup, in which case please ignore this and apologies for the noise.
🔎 Where the scan flagged it here: .github/setup.js is sitting at the tip of gemnasium-badge, master, updated-packages.
Why you should care
- The payload is
.github/setup.js, a lone minified line of about 4.3 MB. A normal git clone leaves it dormant.
- It triggers as soon as the repo is opened in an AI-assisted editor such as Cursor, or VS Code / others with Claude, Gemini, or Copilot agents running. The triggers are the files dropped beside it:
.claude/settings.json / .gemini/settings.json (SessionStart).cursor/rules/setup.mdc (alwaysApply).vscode/tasks.json (folderOpen)- an altered
test script in package.json
- When it runs it steals credentials (GitHub tokens, npm tokens, AWS / GCP / Azure keys, and beyond) and tries to spread onward.
- Net effect: until it's gone, anybody opening this repo in such an editor risks losing their own credentials, starting with you and your contributors.
See for yourself
The signature is .github/setup.js present on any branch, so check every one, not just the default, since it often lurks on stale feature branches. Do it from a clone with nothing checked out so nothing can execute; that's steps 1 and 2 of the cleanup.
How to remove it
⚠️ Don't paste any command, mine or otherwise, without reading it first. Go line by line, understand what each does, and verify it suits your repo. Running code you haven't read is exactly how this began; the cleanup must not repeat that.
Above all else: never let an infected repo run. No AI editor, no npm install, no npm test. Do all of the following from a clone with nothing checked out.
1. Clone with no checkout.
git clone --no-checkout https://github.com/<you>/<repo>.git fix
cd fix
git fetch origin '+refs/heads/*:refs/remotes/origin/*'
2. Spot the payload on every branch.
git for-each-ref --format='%(refname:short)' refs/remotes/origin | while read b; do
git cat-file -e "$b:.github/setup.js" 2>/dev/null && echo "INFECTED: $b"
done
3. Save the evidence once.
git clone --mirror https://github.com/<you>/<repo>.git evidence.git
tar czf evidence.tar.gz evidence.git
4. Excise the malicious commit on each infected branch. With this worm it's almost always the branch tip, so reset the branch to that commit's parent:
git log -1 origin/<branch> -- .github/setup.js # confirm it is the latest commit
git push --force-with-lease origin <MALICIOUS_SHA>^:refs/heads/<branch>
Use a reset, not git revert. A revert leaves the payload retrievable at the old commit. (If genuine commits sit on top of the malicious one, don't run this as-is; rebase just the bad commit out.)
5. Clear out the unreachable copies. Because of the fork network, a commit can remain reachable by SHA after it's off every branch. Open a support ticket with the malicious SHAs and ask them to garbage-collect and purge it through the sensitive-data removal process.
Finally, rotate whatever might have leaked: personal access tokens, Actions secrets, npm tokens, cloud keys. If the repo was ever opened or run in an editor on any machine, treat those credentials as compromised.
These are the essentials; for the most up-to-date version and a deeper explanation, see my write-up: https://dev.to/icflorescu/if-the-shai-hulud-worm-reached-your-github-repos-please-read-this-1pok
More if you're curious
I'm not tied to GitHub and have nothing to gain.
I simply went through this and don't want it spreading further.
Happy to help if you get stuck.
Stay safe. 🙏
Hey, I'm Ionut Cristian Florescu, a maintainer who got hit, along with my community, by this exact worm in early June 2026. I'm deliberately raising an issue here instead of reporting the repo. A report mostly results in the repository being disabled, which punishes you, the owner, rather than solving anything. I learned that the hard way. Cleaning it up yourself is the better path.
A read-only sweep of public repos still finds the payload on one or more branches here. This might be a false positive, or you may already be mid-cleanup, in which case please ignore this and apologies for the noise.
Why you should care
.github/setup.js, a lone minified line of about 4.3 MB. A normalgit cloneleaves it dormant..claude/settings.json/.gemini/settings.json(SessionStart).cursor/rules/setup.mdc(alwaysApply).vscode/tasks.json(folderOpen)testscript inpackage.jsonSee for yourself
The signature is
.github/setup.jspresent on any branch, so check every one, not just the default, since it often lurks on stale feature branches. Do it from a clone with nothing checked out so nothing can execute; that's steps 1 and 2 of the cleanup.How to remove it
Above all else: never let an infected repo run. No AI editor, no
npm install, nonpm test. Do all of the following from a clone with nothing checked out.1. Clone with no checkout.
2. Spot the payload on every branch.
3. Save the evidence once.
4. Excise the malicious commit on each infected branch. With this worm it's almost always the branch tip, so reset the branch to that commit's parent:
Use a reset, not
git revert. A revert leaves the payload retrievable at the old commit. (If genuine commits sit on top of the malicious one, don't run this as-is; rebase just the bad commit out.)5. Clear out the unreachable copies. Because of the fork network, a commit can remain reachable by SHA after it's off every branch. Open a support ticket with the malicious SHAs and ask them to garbage-collect and purge it through the sensitive-data removal process.
Finally, rotate whatever might have leaked: personal access tokens, Actions secrets, npm tokens, cloud keys. If the repo was ever opened or run in an editor on any machine, treat those credentials as compromised.
These are the essentials; for the most up-to-date version and a deeper explanation, see my write-up: https://dev.to/icflorescu/if-the-shai-hulud-worm-reached-your-github-repos-please-read-this-1pok
More if you're curious
I'm not tied to GitHub and have nothing to gain.
I simply went through this and don't want it spreading further.
Happy to help if you get stuck.
Stay safe. 🙏