Nish Tahir on Mythryl: “When triggered the dead man's switch supposedly wipes the users PC…”

New mini shai-hulud with a dead man's set to trigger if the user revokes the compromised GitHub token. Acts as a true worm enumerating and publishing a compromised package to any packages the compromised target has access to.

stepsecurity.ioTeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages - StepSecurityThe Mini Shai-Hulud worm is actively compromising legitimate npm packages by hijacking CI/CD pipelines and stealing developer secrets. StepSecurity's OSS Package Security Feed first detected the attac...

Post