Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code
Malicious npm packages, including Mini Shai-Hulud, steal developer and CI/CD cloud credentials during install.
2
Stories per day · 30 days
1 RSS
3 stories, newest first · one card per story
Stories tagged #mini-shai-hulud
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.
2
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.
2