Shai-Hulud

Shai-Hulud is a family of malware that spreads through supply chain attacks, infecting legitimate software packages on repositories like npm and PyPI to be downloaded by developers.

Why it’s in the news: It is in the news due to a recent, widespread campaign that has compromised over 100 packages and been downloaded tens of thousands of times.

Latest on Shai-Hulud

• The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one
• Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks
• 'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud
• Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week
• The Hackers Behind Shai-Hulud: Lucky or Skilled?
• Mini Shai-Hulud Hits Hundreds of npm Packages in AntV Ecosystem
• poisoned versions of keyv and its sibling caching packages were live on npm, carrying a credential-stealing worm
• By midday, security firm Aikido counted at least 868 compromised packages across 1,381 versions, together carrying over two billion monthly installs, a total still climbing.
• An attacker on Tuesday took over the GitHub account of the developer who maintains keyv, a small key-value storage library that npm serves roughly 127 million times a week. Within hours, poisoned versions of keyv and its sibling caching packages were live on npm, carrying a credential-stealing worm.

Connections

3 entities linked to Shai-Hulud across the news graph.