Threats Tagged 'shai-hulud v2'

Shai-Hulud V2 is an advanced malware campaign targeting the npm software supply chain, compromising over 700 npm packages and creating more than 27,000 malicious GitHub repositories. It introduces sophisticated techniques including pre-install phase execution, persistent backdoors via self-hosted GitHub Actions runners, credential harvesting and recycling across victims, and a destructive failsafe mechanism. The malware exfiltrates data through GitHub and propagates within the npm ecosystem, also exploiting Azure DevOps build agents. This supply chain attack enables persistent remote code execution and widespread credential theft without requiring user interaction. European organizations relying on npm packages and GitHub Actions for CI/CD pipelines face significant risks of data breaches, system compromise, and operational disruption. Mitigation requires enhanced supply chain security practices, strict GitHub Actions runner controls, credential hygiene, and proactive monitoring for anomalous activity. Countries with strong software development sectors and high npm usage, such as Germany, France, the UK, and the Netherlands, are particularly vulnerable. Given its broad impact and advanced persistence mechanisms, the threat severity is assessed as high.

MediumMalwareGermanyFranceNetherlands+4#exfiltration#github#supply chain