PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shai-Hulud 2.0: What Security Leaders Need to Do Now

hackerone.com | blog | #supply-chain | #secrets | #malware | #credential-theft | #npm | #ci-cd | #javascript | #worm | #shai-hulud
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Shai-Hulud 2.0 is a self-replicating npm worm stealing secrets from dev and CI/CD environments; with 1,000+ packages and 27,000+ repos hit, rotate credentials and disable lifecycle scripts.
Published
Collected

Related coverage

blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
blog · aikido.dev
Shai-Hulud Rises From the Dead after 111 days
The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · metabase.com
More, Better, Faster: How we automate Metabase releases
How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
Back