Shai-Hulud Npm Worm Activity is a threat campaign tracked by ThreatCluster, appearing in 2 threat clusters built from 1 intelligence report mention.
Shai-Hulud Npm Worm Activity is a threat campaign tracked across 2 threat clusters and 1 intelligence report mention on ThreatCluster. First observed August 4, 2026; most recent activity August 4, 2026.
A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into…
On August 4, 2026, attackers compromised the release path for keyv and cacheable npm packages, publishing trojanized versions starting with [email protected]. The malicious packages included a preinstall hook that executed an…
Shai-Hulud Npm Worm Activity is a threat campaign tracked by ThreatCluster, appearing in 2 threat clusters built from 1 intelligence report mention.
The most recent intelligence report mentioning Shai-Hulud Npm Worm Activity on ThreatCluster is dated August 4, 2026.
Across ThreatCluster reporting, Shai-Hulud Npm Worm Activity most frequently co-occurs with Malware, Supply Chain Attack, Trojan, Worm, Shai-hulud, among 12 tracked related entities.
The most significant recent cluster is “Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages” (708 articles · Updated April 29, 2026). Shai-Hulud Npm Worm Activity appears across 2 threat clusters in total, listed above with sources.
Shai-Hulud Npm Worm Activity appears in 1 intelligence report mention across 2 deduplicated threat clusters, aggregated from 17,000+ monitored sources.