LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S9008: Shai-Hulud

Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]

EnterpriseS9008MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Shai-Hulud matters because it targets the software supply chain rather than only endpoints. The ATT&CK description identifies it as a worm that spreads through code repositories, GitHub, NPM packages, and CI/CD dependencies, then steals credentials and access tokens and exfiltrates them through encoded GitHub Actions workflows. For executives and security leaders, the practical risk is loss of trust in build pipelines, package dependencies, and repository identities that can affect software delivery, incident scope, and customer assurance.

Executive priority

Prioritize validation of software supply chain controls: repository account security, CI/CD secret handling, package publishing governance, and evidence that build workflows are monitored. This behavior can turn a compromised developer or package dependency into a broader business continuity and compliance problem because stolen tokens may allow follow-on access across repositories, SaaS services, and build infrastructure. Leaders should ask whether the organization can rapidly identify affected packages, revoke exposed tokens, pause unsafe publishing, and prove control effectiveness to auditors or customers.

Technical view

SOC, detection engineering, and IR teams should treat Shai-Hulud as a cross-platform software supply chain threat affecting Linux, Windows, and SaaS environments. Because ATT&CK provides no official detection text or tactic mapping for this object, teams should validate coverage around the behaviors in the description: suspicious repository account activity, unexpected GitHub Actions workflow creation or modification, encoded workflow content, anomalous CI/CD dependency execution, unexpected NPM/package publishing, and outbound connections from build automation to attacker-controlled or unapproved destinations. IR playbooks should include token discovery, revocation, repository review, package integrity checks, and CI/CD workflow containment.

Likely telemetry

  • Repository audit logs for account activity, token usage, workflow changes, branch/tag changes, and package publishing events
  • CI/CD pipeline logs from GitHub Actions or equivalent workflow systems, including job definitions, environment variables, secrets access, and runner activity
  • SaaS identity and access logs for repository accounts, service accounts, access tokens, and unusual authentication patterns
  • Package registry logs for NPM or internal package publication, version changes, maintainer changes, and dependency updates
  • Endpoint and build runner telemetry from Linux and Windows systems used in development or CI/CD processes

Detection direction

  • Validate that repository and CI/CD audit logs are collected with enough detail to reconstruct who changed workflows, published packages, and used tokens.
  • Tune detections for unusual GitHub Actions workflow creation, encoded script content, unexpected secrets access, and workflow changes made by accounts that do not normally maintain automation.
  • Monitor for package publishing from unusual accounts, locations, runners, or time windows, while accounting for legitimate release automation to reduce false positives.
  • Correlate repository events with SaaS identity logs and build runner telemetry; single-source alerts may miss supply chain propagation across accounts, packages, and pipelines.
  • Review blind spots around ephemeral CI/CD runners, unmanaged developer tokens, personal access tokens, third-party actions, and dependencies pulled during builds.

Mitigation priorities

  • Inventory critical repositories, CI/CD workflows, package publishing rights, service accounts, and access tokens before an incident.
  • Enforce least privilege and strong governance for repository accounts, package maintainers, CI/CD secrets, and publishing workflows.
  • Reduce token exposure by rotating secrets, limiting token scope and lifetime, and preventing unnecessary secrets access in build jobs.
  • Require review and approval for workflow changes, package publishing changes, and dependency updates in sensitive projects.
  • Use secret scanning, dependency review, and package integrity checks to identify exposed credentials and suspicious package changes.
Additional notes and limits

The supplied ATT&CK object describes Shai-Hulud as a supply chain worm involving repositories, GitHub, NPM packages, CI/CD dependencies, credential and token theft, and exfiltration through encoded GitHub Actions workflows. No ATT&CK tactics, aliases, official detection text, external reference details, or relationship mappings were supplied, so this take focuses on defensible validation areas rather than specific ATT&CK technique coverage.

This summary is limited to the supplied STIX fields and description. It does not establish current activity, attribution, prevalence, customer exposure, or guaranteed detection. Local conclusions require environment-specific evidence from repository platforms, CI/CD systems, package registries, identity logs, build runners, and network telemetry.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Shai-Hulud

Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

33 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or Information

Shai-Hulud has utilized double-base64 encoding to store stolen secrets within the Github Action Logs within the victim account.[5][6][7][4] Shai-Hulud has also leveraged three layers of base64 encoding of exfiltrated data for anti-forensic purposes.[3]

EnterpriseT1548.003Sudo and Sudo CachingSub-technique

Shai-Hulud has attempted to gain root access by leveraging `sudo` and `/etc/sudoers.d`.[3]

EnterpriseT1543.002Systemd ServiceSub-technique

Shai-Hulud has stopped `systemd-resolved` in order to manipulate DNS and firewalls.[3]

EnterpriseT1678Delay Execution

Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.[1]

EnterpriseT1677Poisoned Pipeline Execution

Shai-Hulud has also leveraged GitHub actions from stolen accounts in order to create a malicious Github workflow within `.github/workflows/discussion.yaml`.[5][6][1][3]

EnterpriseT1485Data Destruction

Shai-Hulud has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder.[1][3] Shai-Hulud has also utilized the `shred` command on Linux devices.[2]

EnterpriseT1552.001Credentials In FilesSub-technique

Shai-Hulud has gathered sensitive data stored in the Node.JS file `process.env` to include credentials and API keys.[5][3][4] Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include `~/.aws/credentials`, `application_default_credentials.json`, and `azureProfile.json`.[6][1][3][4] Shai-Hulud has also targeted credentials and tokens stored in NPM files `.npmrc` and GitHub config files.[6][1][3][4]

EnterpriseT1685Disable or Modify Tools

Shai-Hulud has replaced DNS configuration from `/tmp/resolved.conf` in order to gain control of network-level control within CI environments and has flushed iptables rules using `sudo iptables -F OUTPUT` and `sudo iptables -F DOCKER-USER`.[3]

EnterpriseT1195.001Compromise Software Dependencies and Development ToolsSub-technique

Shai-Hulud has published itself on compromised code repository maintainers within infected packages in attempts to propagate to other victims.[5][6][7][2][3] Shai-Hulud has also modified versions of code packages.[5][6][7][3]

EnterpriseT1105Ingress Tool Transfer

Shai-Hulud has downloaded packages from code repositories.[5][7][3][4] Shai-Hulud has also downloaded and executed the secrets-discovery tool TruffleHog to gather sensitive data.[6][7][2][3][4]

EnterpriseT1059.004Unix ShellSub-technique

Shai-Hulud has utilized Linux shell commands to modify configuration files.[3]

EnterpriseT1078.004Cloud AccountsSub-technique

Shai-Hulud has leveraged compromised accounts to log into cloud services to access cloud hosted repositories.[5][6][1][7][2]

EnterpriseT1555.006Cloud Secrets Management StoresSub-technique

Shai-Hulud has gathered secrets from AWS Secrets and GCP Secret Manager.[5][6][3] Shai-Hulud has also gathered data from Azure Key Vault.[6][3]

EnterpriseT1564.011Ignore Process InterruptsSub-technique

Shai-Hulud has suppressed NPM warnings by silently exiting through the use of the NPM success code that has a setting that all errors exit with `code 0`.[3]

EnterpriseT1119Automated Collection

Shai-Hulud has the ability to automatically collect host data, secrets, system information, and endpoints.[5][6][2]

EnterpriseT1071.001Web ProtocolsSub-technique

Shai-Hulud has utilized curl to install Bun over HTTPS.[2]

EnterpriseT1593.003Code RepositoriesSub-technique

Shai-Hulud has the ability to search open sites and code repositories for compromised credentials.[5][2] Shai-Hulud has discovered packages associated with compromised accounts.[6] Shai-Hulud has also searched code repositories for other compromised repositories that include predefined parameters or markers to include “Second Coming” combined with an 18-character alphanumeric string.[6]

EnterpriseT1567.001Exfiltration to Code RepositorySub-technique

Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets.[5][6][7] Shai-Hulud has also posted stolen credentials to public GitHub repositories.[1][2][3][4]

EnterpriseT1036.009Break Process TreesSub-technique

Shai-Hulud has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.[1][3]

EnterpriseT1528Steal Application Access Token

Shai-Hulud has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.[6][1][7][3]

EnterpriseT1098Account Manipulation

Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.[5][6][7][2]

EnterpriseT1553Subvert Trust Controls

Shai-Hulud has suppressed victim NPM warnings using `process[“exit’](0x0);` which results in having all errors exit with code 0.[3]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Shai-Hulud has masqueraded as a legitimate Bun installer.[1][3]

EnterpriseT1041Exfiltration Over C2 Channel

Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.[5][1][7]

EnterpriseT1546.016Installer PackagesSub-technique

Shai-Hulud has inserted a new lifecycle hook to include `postinstall`.[5][1][7][3] Shai-Hulud has also leveraged the NPM lifecycle hook `preinstall`.[6][1][2][3]

EnterpriseT1608.001Upload MalwareSub-technique

Shai-Hulud has published malicious gzip-compressed tarball (.tgz) following modification of packages within compromised accounts.[5][4] Shai-Hulud has also modified packages within compromised accounts.[6][7]

EnterpriseT1567.004Exfiltration Over WebhookSub-technique

Shai-Hulud has exfiltrated repository secrets to `webhook[.]site`.[7]

EnterpriseT1213.003Code RepositoriesSub-technique

Shai-Hulud has downloaded existing packages from code repositories and extracted data stored within them.[5]

EnterpriseT1059.001PowerShellSub-technique

Shai-Hulud has utilized PowerShell `Invoke-WebRequest` to download and install the malicious payload.[2]

EnterpriseT1552.005Cloud Instance Metadata APISub-technique

Shai-Hulud has queried the AWS and GCP metadata endpoints for instances and service credentials.[5]

EnterpriseT1082System Information Discovery

Shai-Hulud has gathered victim system information.[5][3]

EnterpriseT1550.001Application Access TokenSub-technique

Shai-Hulud has leveraged captured valid NPM tokens to enumerate and update packages on compromised accounts.[5][3][4] Shai-Hulud has also utilized stolen GitHub access tokens to access compromised accounts.[3][4]

EnterpriseT1059.007JavaScriptSub-technique

Shai-Hulud has used JavaScript to create JSON file output and run scripts using node.js.[5][6][1][7][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1548.003: Sudo and Sudo CachingEnterpriseuses · TechniqueT1543.002: Systemd ServiceEnterpriseuses · TechniqueT1678: Delay ExecutionEnterpriseuses · TechniqueT1677: Poisoned Pipeline ExecutionEnterpriseuses · TechniqueT1485: Data DestructionEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1195.001: Compromise Software Dependencies and Development ToolsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1078.004: Cloud AccountsEnterpriseuses · TechniqueT1555.006: Cloud Secrets Management StoresEnterpriseuses · TechniqueT1564.011: Ignore Process InterruptsEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1593.003: Code RepositoriesEnterpriseuses · TechniqueT1567.001: Exfiltration to Code RepositoryEnterpriseuses · TechniqueT1036.009: Break Process TreesEnterpriseuses · TechniqueT1528: Steal Application Access TokenEnterpriseuses · TechniqueT1098: Account ManipulationEnterpriseuses · TechniqueT1553: Subvert Trust ControlsEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
972106ec13706bcf...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle972106ec1370…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  2. [2]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  3. [3]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  4. [4]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  5. [5]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  6. [6]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  7. [7]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  8. [8]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  9. [9]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  10. [10]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  11. [11]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  12. [12]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  13. [13]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  14. [14]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  15. [15]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  16. [16]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  17. [17]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  18. [18]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  19. [19]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  20. [20]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  21. [21]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  22. [22]
    mitre-attackS9008
    Open source URL
  23. [23]
    mitre-attackS9008
    Open source URL
  24. [24]
    mitre-attackS9008
    Open source URL
  25. [25]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  26. [26]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  27. [27]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  28. [28]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  29. [29]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  30. [30]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  31. [31]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  32. [32]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  33. [33]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  34. [34]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  35. [35]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  36. [36]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  37. [37]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  38. [38]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  39. [39]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  40. [40]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  41. [41]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  42. [42]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  43. [43]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  44. [44]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  45. [45]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  46. [46]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  47. [47]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  48. [48]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  49. [49]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  50. [50]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  51. [51]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  52. [52]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  53. [53]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  54. [54]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  55. [55]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  56. [56]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  57. [57]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  58. [58]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  59. [59]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  60. [60]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  61. [61]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  62. [62]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  63. [63]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  64. [64]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  65. [65]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  66. [66]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  67. [67]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  68. [68]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  69. [69]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  70. [70]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  71. [71]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  72. [72]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  73. [73]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  74. [74]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  75. [75]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  76. [76]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  77. [77]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  78. [78]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  79. [79]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  80. [80]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  81. [81]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  82. [82]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  83. [83]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  84. [84]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  85. [85]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  86. [86]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  87. [87]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  88. [88]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  89. [89]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  90. [90]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  91. [91]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  92. [92]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  93. [93]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  94. [94]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  95. [95]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  96. [96]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  97. [97]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  98. [98]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  99. [99]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  100. [100]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  101. [101]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  102. [102]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  103. [103]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  104. [104]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  105. [105]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  106. [106]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  107. [107]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  108. [108]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  109. [109]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  110. [110]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  111. [111]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  112. [112]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  113. [113]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  114. [114]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  115. [115]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  116. [116]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  117. [117]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  118. [118]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  119. [119]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  120. [120]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  121. [121]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  122. [122]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  123. [123]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  124. [124]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  125. [125]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  126. [126]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  127. [127]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  128. [128]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  129. [129]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  130. [130]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  131. [131]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  132. [132]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  133. [133]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  134. [134]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  135. [135]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  136. [136]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  137. [137]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  138. [138]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  139. [139]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  140. [140]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  141. [141]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  142. [142]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  143. [143]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  144. [144]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  145. [145]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  146. [146]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  147. [147]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  148. [148]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  149. [149]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  150. [150]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  151. [151]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  152. [152]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  153. [153]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  154. [154]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  155. [155]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  156. [156]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  157. [157]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  158. [158]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  159. [159]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  160. [160]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  161. [161]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  162. [162]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  163. [163]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  164. [164]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  165. [165]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  166. [166]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  167. [167]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  168. [168]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  169. [169]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  170. [170]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  171. [171]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  172. [172]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  173. [173]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  174. [174]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  175. [175]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  176. [176]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  177. [177]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  178. [178]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  179. [179]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  180. [180]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  181. [181]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  182. [182]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  183. [183]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  184. [184]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  185. [185]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  186. [186]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  187. [187]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  188. [188]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  189. [189]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  190. [190]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
  191. [191]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  192. [192]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  193. [193]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  194. [194]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  195. [195]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  196. [196]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  197. [197]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  198. [198]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  199. [199]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  200. [200]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  201. [201]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  202. [202]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  203. [203]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  204. [204]
    Aikido Shai-Hulud September 2025

    Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.

    Open source URL
  205. [205]
    Microsoft Shai-Hulud December 2025

    Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.

    Open source URL
  206. [206]
    Netskope Shai-Hulud November 2025

    Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.

    Open source URL
  207. [207]
    Palo Alto Unit 42 Shai-Hulud November 2025

    Justin Moore. (2025, November 25). "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.

    Open source URL
  208. [208]
    Socket Shai-Hulud November 2025

    Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.

    Open source URL
  209. [209]
    Socket Shai-Hulud Trufflehog September 2025

    Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.

    Open source URL
  210. [210]
    Wiz Shai-Hulud September 2025

    Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use