[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWRZE5LBSGO-g90grZOGfwSc43VMwLO73QcfGu8RXKwU":3},{"article":4,"iocs":56,"watch_terms":63,"solutions":64,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"79a4a19d-b011-49b7-a57b-519b61936d3b","Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks","over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks-58c2a0","The most recent variants of the self-propagating attacks are named Miasma and Hades. The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek.","New variants of the Shai-Hulud supply chain attack, named Miasma and Hades, have compromised over 100 packages in the NPM and PyPI ecosystems. These self-propagating worms target open-source software, stealing credentials and API keys to spread further. The attack has seen a surge since the source code was released in May, with notable incidents affecting Red Hat's ecosystem and numerous bioinformatics and machine learning packages.","Shai-Hulud worm infects over 100 NPM and PyPI packages with Miasma and Hades variants.","https:\u002F\u002Fwww.securityweek.com\u002Fover-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fsupply-chain-threat.webp","2026-06-09T11:37:11+00:00","2026-06-09T12:00:13.490225+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"TeamPCP","threat_actor",{"name":21,"type":22},"Shai-Hulud","campaign",{"name":24,"type":25},"NPM","product",{"name":27,"type":25},"PyPI",{"name":29,"type":25},"Hybrid Cloud Console",{"name":31,"type":32},"Red Hat","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60],{"type":45,"value":58,"context":59},"Miasma","Variant of Shai-Hulud worm targeting NPM packages.",{"type":45,"value":61,"context":62},"Hades","Variant of Shai-Hulud worm targeting PyPI packages.",[31,24,27],{"controls":65,"vendors":143},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":125,"name":126,"problem":127,"products":128},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[129,137,138],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":139,"product_name":140,"url":141,"description":142},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[144,150,155],{"slug":145,"name":146,"logo_path":147,"roles":148},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png",[149],"reported_by",{"slug":151,"name":152,"logo_path":153,"roles":154},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png",[149],{"slug":156,"name":157,"logo_path":158,"roles":159},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png",[149],{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":170},"self-propagating-worms-target-open-source-package-repositories","Self-Propagating Worms Target Open Source Package Repositories","The Shai-Hulud attack variants demonstrate how malicious code can infiltrate trusted open-source repositories and self-propagate by stealing credentials and API keys. These worms specifically target NPM and PyPI ecosystems, affecting over 100 packages including critical infrastructure used by major organizations like Red Hat. The attack's ability to spread autonomously through compromised developer credentials makes it particularly dangerous, as each infected package becomes a vector for further compromise. Organizations relying on open-source packages without proper vetting and monitoring face significant risk of credential theft and unauthorized access to their development environments.",[165,166,167,168,169],"CIS Control 2","NIST SP 800-161","NIST SSDF","SLSA Framework","ISO 27001 A.14.2.1",{}]