#shai-hulud
3 cases
Shai-Hulud via a hijacked AI coding-assistant session: Mandiant's case of a poisoned recommendation that spread a wormSupply Chain AttackAI & Machine LearningMalware
Mandiant documents an intrusion where an AI coding assistant recommended attacker-poisoned software; a developer accepted it, and the attacker used the live session to steal GitHub OAuth tokens and spread the Shai-Hulud worm across ~100 internal repos. How the session was taken over is undisclosed.
Supply Chain AttackAI & Machine LearningMalware
keyv npm Compromise: A Credential-Stealing Worm That Shipped With Valid ProvenanceSupply Chain AttackMalware
The malicious release carried valid SLSA provenance and passed every integrity check, because the honest build pipeline compiled source that was already poisoned. It also ran when a developer merely opened the folder.
Supply Chain AttackMalware
ChainDrop and the Shai-Hulud Lineage: Anatomy of a Self-Propagating npm Supply Chain WormMalwareSupply Chain Attack
Between late 2025 and mid-2026, the software supply chain threat landscape underwent a fundamental paradigm shift with the emergence of the Shai-Hulud malware lineage. Culminating in the highly...
MalwareSupply Chain Attack