PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact

wiz.io | incident | #supply-chain | #incident-response | #npm | #shai-hulud | #wiz-research | #victimology
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research's Shai-Hulud 2.0 aftermath: infection trends including a December 1 spike of 200+ new repos in 12 hours, victimology, leaked-secret distribution and the community containment response.
Published
Collected

Related coverage

incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
blog · wiz.io
Snipping the Long Tail of Shai-Hulud 2.0
Wiz Research on Shai-Hulud 2.0's long tail: infections ran 100-200 repos/day, 90%+ via a zombie OpenVSX extension; a clean release cut it to a handful, while leaked secrets remain unrotated.
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
incident · wiz.io
keyv and cacheable npm Package Hijacked in Supply Chain Attack
Wiz: keyv/cacheable packages were hijacked via a maintainer account; a Mini Shai-Hulud descendant hit 400+ packages, stealing credentials, AI configs and wallets; C2 via an Ethereum contract.
incident · wiz.io
Miasma: Supply Chain Attack Targeting RedHat npm Packages
Wiz Research found Miasma, a supply-chain attack on @redhat-cloud-services npm: 32+ tampered releases (~80k weekly downloads) carried a Shai-Hulud-derived payload targeting GCP and Azure identities.
incident · wiz.io
Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond
Wiz dissects the npm debug/chalk incident: releases live ~2 hours carried a wallet-hijacking browser interceptor into affected builds; telemetry quantifies ~99% prevalence and ~10% malware presence.
Back