---
id: 6665
title: "Shai-Hulud npm supply chain attack – new compromised packages detected"
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/shai-hulud-npm-supply-chain-attack-new-compromised-packages-detected/"
published_at: "2025-11-24T19:03:27Z"
tags: ["ai-security", "cloud", "supply-chain", "malware", "credential-theft", "npm", "jfrog", "shai-hulud", "jfrog-com"]
phying_url: "https://phying.com/item/6665"
lang: en
---

# Shai-Hulud npm supply chain attack – new compromised packages detected

## Summary

JFrog details Shai-Hulud's second wave: 796 new malicious npm packages with stronger obfuscation and persistence, stealing GitHub, npm, AWS and GCP credentials via a TruffleHog-based stealer.

## Intelligence Metadata

- **Sources:** jfrog.com
- **Published:** 2025-11-24T19:03:27Z
- **Original:** https://jfrog.com/blog/shai-hulud-npm-supply-chain-attack-new-compromised-packages-detected/
- **Phying News:** https://phying.com/item/6665