Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm

aikido.dev | blog | #cloud | #supply-chain | #credential-theft | #npm | #ci-cd | #supply-chain-security | #worm | #shai-hulud | #bitwarden

Summary

A malicious @bitwarden/cli release carried a self-propagating worm self-named 'Shai-Hulud: The Third Coming', harvesting SSH keys, cloud secrets, and MCP configs via Bitwarden's compromised CI pipeline.
Published
Collected

original ↗

Related coverage

  1. Shai-Hulud Rises From the Dead after 111 days (aikido.dev)
  2. Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack (aikido.dev)
  3. Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware (wiz.io)
  4. keyv and cacheable npm Package Hijacked in Supply Chain Attack (wiz.io)
  5. Good riddance, TeamPCP. Now for the hard part. (aikido.dev)
  6. Shai-Hulud was the best thing to happen to supply chain security (aikido.dev)

back