Loading threat actor…
Shai-Hulud 2.0 is the designation for the operators behind a large-scale npm supply-chain worm that propagated through widely used JavaScript packages and infected more than 30,000 repositories. The campaign primarily impacted CI/CD environments rather than developer endpoints, indicating an emphasis on compromising automated build and deployment pipelines at scale. Reported infection vectors included compromised npm packages such as @postman/tunnel-agent and @asyncapi/specs. The operators used the worm to spread through software development ecosystems and to harvest access material from cloud and package-management environments. Observed objectives included exfiltration attempts against cloud secrets associated with AWS, Google Cloud, and Azure, as well as leakage of npm authentication tokens. Although coding errors reportedly caused many exfiltrated files to be empty, the campaign still resulted in exposure of active npm tokens and demonstrated meaningful capability in software supply-chain compromise, credential theft, and automated post-compromise propagation. Shai-Hulud 2.0 is best characterized as a supply-chain-focused intrusion set rather than a formally established nation-state or ransomware brand. High-confidence reporting supports capabilities in initial access through trusted package ecosystems, persistence within CI/CD workflows during the worm's active period, and exfiltration of secrets from development and cloud environments. Publicly available information in this context does not firmly attribute the operators to a specific country or broader named threat cluster.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.