shai-hulud

ChainCatcher tin tức, theo thông báo từ Slow Fog, đã phát hiện biến thể mới Shai-Hulud Hades đang tấn công PyPI. Gói độc hại sẽ triển khai tệp .pth, tự động thực thi khi Python khởi động, và kiểm tra xem Bun có được cài đặt trên máy địa phương hay không; nếu chưa cài đặt, nó sẽ tải xuống tệp nhị phân Bun chính thức từ GitHub Releases, sau đó thực thi tải trọng JavaScript được làm mờ nhiều lớp, nhằm đánh cắp thông tin xác thực từ GitHub, npm, AWS và các dịch vụ đám mây.Slow Fog cho biết, biến thể này sử dụng cùng một khóa công khai RSA và cơ sở hạ tầng như cuộc tấn công Shai-Hulud trước đó, và có khả năng mã hóa dữ liệu, duy trì, tiêm CI/CD và tiêm GitHub Actions.

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

The Chief Information Security Officer of Slow Fog Technology, 23pds, has issued a security alert regarding the latest variant of the NPM supply chain attack, "Shai-Hulud 3." All project teams and platforms are advised to take precautions. It was previously suspected that the leak of the Trust Wallet API key could have led to the Shai-Hulud 2 attack.Shai-Hulud is a series of self-propagating worm-like supply chain attacks targeting the NPM ecosystem, aimed at stealing developer credentials, cloud keys, and environment secrets. The latest variant (referred to by the community as Shai-Hulud 3 or new strain) was discovered on December 28, 2025, by Aikido Security researcher Charlie Eriksen. The current spread is limited and may only be in the testing phase.

Chief Information Security Officer of Slow Fog Technology 23pds issued a security alert, the latest variant of the NPM supply chain attack "Shai-Hulud 3" is once again on the rise. All project parties and platforms are advised to take precautions. It was previously suspected that the leak of the Trust Wallet API key might have led to the Shai-Hulud 2 attack.