shai-hulud

Сообщение ChainCatcher, согласно данным Slow Fog, обнаружило, что новый вариант Shai-Hulud Hades атакует PyPI. Зловредный пакет будет загружать .pth файл, который автоматически выполняется при запуске Python и проверяет, установлен ли Bun; если не установлен, то загружает официальный бинарный файл Bun с GitHub Releases, а затем выполняет многослойный замаскированный JavaScript-код для кражи учетных данных GitHub, npm, AWS и облачных сервисов.Slow Fog утверждает, что этот вариант использует тот же RSA открытый ключ и инфраструктуру, что и предыдущие атаки Shai-Hulud, и обладает возможностями шифрования, постоянного хранения, инъекции CI/CD и инъекции GitHub Actions.

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

The Chief Information Security Officer of Slow Fog Technology, 23pds, has issued a security alert regarding the latest variant of the NPM supply chain attack, "Shai-Hulud 3." All project teams and platforms are advised to take precautions. It was previously suspected that the leak of the Trust Wallet API key could have led to the Shai-Hulud 2 attack.Shai-Hulud is a series of self-propagating worm-like supply chain attacks targeting the NPM ecosystem, aimed at stealing developer credentials, cloud keys, and environment secrets. The latest variant (referred to by the community as Shai-Hulud 3 or new strain) was discovered on December 28, 2025, by Aikido Security researcher Charlie Eriksen. The current spread is limited and may only be in the testing phase.

Chief Information Security Officer of Slow Fog Technology 23pds issued a security alert, the latest variant of the NPM supply chain attack "Shai-Hulud 3" is once again on the rise. All project parties and platforms are advised to take precautions. It was previously suspected that the leak of the Trust Wallet API key might have led to the Shai-Hulud 2 attack.