PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets

wiz.io | incident | #supply-chain | #secrets | #malware | #github | #npm | #shai-hulud | #wiz-research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
Published
Collected

Related coverage

blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
incident · wiz.io
Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact
Wiz Research's Shai-Hulud 2.0 aftermath: infection trends including a December 1 spike of 200+ new repos in 12 hours, victimology, leaked-secret distribution and the community containment response.
incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
blog · wiz.io
Snipping the Long Tail of Shai-Hulud 2.0
Wiz Research on Shai-Hulud 2.0's long tail: infections ran 100-200 repos/day, 90%+ via a zombie OpenVSX extension; a clean release cut it to a handful, while leaked secrets remain unrotated.
research · wiz.io
Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks
Wiz scanned the Forbes AI 50 and found 65% of leading private AI companies had verified secret leaks on GitHub — API keys and tokens buried in deleted forks and gists that standard scanners miss.
incident · wiz.io
keyv and cacheable npm Package Hijacked in Supply Chain Attack
Wiz: keyv/cacheable packages were hijacked via a maintainer account; a Mini Shai-Hulud descendant hit 400+ packages, stealing credentials, AI configs and wallets; C2 via an Ethereum contract.
Back