Shai-Hulud

Shai-Hulud Malicious GitHub Workflow Creation

Oct 19, 2025 · attack.persistence attack.credential-access attack.t1552.001 attack.collection attack.t1119 detection.emerging-threats ·

Share on:

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Shai-Hulud NPM Attack GitHub Activity

Oct 19, 2025 · attack.persistence attack.impact detection.emerging-threats ·

Share on:

Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.

Shai-Hulud NPM Package Malicious Exfiltration via Curl

Oct 19, 2025 · attack.exfiltration attack.t1041 attack.collection attack.t1005 detection.emerging-threats ·

Share on:

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.