Shai-Hulud 2 Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
2
occurrences
First Seen
November 25, 2025
Last Seen
December 15, 2025

Related Threat Clusters

  • Shai Hulud npm Worm Compromises Over 26,000 Repositories

    The Shai Hulud worm has compromised more than 26,000 public repositories in a supply chain attack. The attack targeted various npm packages, exploiting vulnerabilities that allowed unauthorized access to these…

    32 articles · Updated November 24, 2025
  • Shai-Hulud Malware Infects npm Packages, Compromising Thousands of Repositories

    A new wave of the Shai-Hulud malware has compromised nearly 500 npm packages, affecting over 26,000 GitHub repositories. This self-replicating worm, which targets developers' credentials and secrets, has been linked to…

    43 articles · Updated November 29, 2025
  • AWS Responds to npm Supply Chain Threat Campaigns

    AWS incident response teams have been actively addressing high-profile software supply chain threats targeting third-party software repositories. These campaigns have affected organizations across various sectors,…

    1 article · Updated December 15, 2025

Recent Intelligence Reports

  • What AWS Security learned from responding to recent npm supply chain threat campaigns — Aws.Amazon · December 15, 2025
  • New Shai — Infosecurity-Magazine · November 25, 2025

CVSS v3.1 Breakdown