PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Snipping the Long Tail of Shai-Hulud 2.0

wiz.io | blog | #cloud | #supply-chain | #npm | #shai-hulud | #credential-rotation | #wiz-research | #openvsx
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research on Shai-Hulud 2.0's long tail: infections ran 100-200 repos/day, 90%+ via a zombie OpenVSX extension; a clean release cut it to a handful, while leaked secrets remain unrotated.
Published
Collected

Related coverage

blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
incident · wiz.io
Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact
Wiz Research's Shai-Hulud 2.0 aftermath: infection trends including a December 1 spike of 200+ new repos in 12 hours, victimology, leaked-secret distribution and the community containment response.
incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
blog · aikido.dev
Shai-Hulud Rises From the Dead after 111 days
The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.
Back