PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shai-Hulud Rises From the Dead after 111 days

aikido.dev | blog | #supply-chain | #malware | #npm | #worm | #shai-hulud | #antv
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.
Published
Collected

Related coverage

blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
blog · aikido.dev
Good riddance, TeamPCP. Now for the hard part.
This incident analysis explains systemic gaps in package registry security exposed by recent malicious campaigns.
blog · aikido.dev
Shai-Hulud was the best thing to happen to supply chain security
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · aikido.dev
Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack
The npm worm Mini Shai-Hulud has grown to 373 malicious versions across 169 packages, including TanStack and Mistral AI, stealing developer credentials and spreading through trusted publishing paths.
blog · aikido.dev
Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm
A malicious @bitwarden/cli release carried a self-propagating worm self-named 'Shai-Hulud: The Third Coming', harvesting SSH keys, cloud secrets, and MCP configs via Bitwarden's compromised CI pipeline.
Back