Shai-Hulud

Shai-Hulud 2.0 Malicious NPM Package Installation

Mar 29, 2026 · attack.initial-access attack.execution attack.t1195.002 detection.emerging-threats ·

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

Shai-Hulud 2.0 Malicious NPM Package Installation - Linux

Mar 29, 2026 · attack.initial-access attack.execution attack.t1195.002 detection.emerging-threats ·

Share on:

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

Shai-Hulud Malicious Bun Execution

Mar 29, 2026 · attack.t1195.002 attack.t1203 attack.execution attack.initial-access detection.emerging-threats ·

Share on:

Detects the execution of bun_environment.js via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a setup_bun.js script to install the Bun runtime if not present, and then executes the malicious bun_environment.js payload.

Shai-Hulud Malicious Bun Execution - Linux

Mar 29, 2026 · attack.t1195.002 attack.t1203 attack.execution attack.initial-access detection.emerging-threats ·

Share on:

Detects the execution of bun_environment.js via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a setup_bun.js script to install the Bun runtime if not present, and then executes the malicious bun_environment.js payload.

Shai-Hulud Malicious GitHub Workflow Creation

Mar 29, 2026 · attack.persistence attack.credential-access attack.t1552.001 attack.collection attack.t1119 detection.emerging-threats ·

Share on:

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Shai-Hulud Malware Indicators - Linux

Mar 29, 2026 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Shai-Hulud Malware Indicators - Windows

Mar 29, 2026 · attack.execution attack.t1059 detection.emerging-threats ·

Share on:

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Shai-Hulud NPM Package Malicious Exfiltration via Curl

Oct 19, 2025 · attack.exfiltration attack.t1041 attack.collection attack.t1005 detection.emerging-threats ·

Share on:

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.