Defending Against Sha1-Hulud: The Second Coming

Sha1-Hulud is a sophisticated new variant of an NPM supply chain attack that executes during the preinstall phase of popular packages like Postman, Zapier, and AsyncAPI. It harvests cloud credentials across AWS, Azure, and GCP, and establishes persistence by creating a self-hosted GitHub Actions runner named 'SHA1HULUD' with an injection-vulnerable workflow. This enables attackers to move laterally across cloud environments beyond the initial development environment. Immediate mitigation includes removing compromised packages, revoking and regenerating all tokens and credentials, and enforcing hardware-based MFA for developer accounts. The attack leverages multiple MITRE ATT&CK techniques related to execution, persistence, credential access, and lateral movement. No known exploits in the wild have been reported yet, but the threat poses a medium severity risk due to its potential impact on cloud infrastructure security and software supply chains.

• Inside a Self-Propagating npm WormMalware2026-08-07
• Here We Go Again · JavaScript Payload AnalysisMalware2026-08-06
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsMalware2026-10-21
• LiteLLM supply chain compromiseCampaign2026-10-22