Shai-Hulud

{
  "id": "ATTACK:enterprise:S9008",
  "title": "Shai-Hulud",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9008",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--de376fb9-1093-4f59-8d13-aed61042701d",
  "external_id": "S9008",
  "domain": "enterprise",
  "created": "2026-04-09T18:24:26.568Z",
  "modified": "2026-04-24T00:04:27.563Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Aikido Shai-Hulud September 2025",
      "url": "https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"
    },
    {
      "source_name": "Netskope Shai-Hulud November 2025",
      "url": "https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"
    },
    {
      "source_name": "Palo Alto Unit 42 Shai-Hulud November 2025",
      "url": "https://unit42.paloaltonetworks.com/npm-supply-chain-attack/"
    },
    {
      "source_name": "Wiz Shai-Hulud September 2025",
      "url": "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"
    },
    {
      "source_name": "Microsoft Shai-Hulud December 2025",
      "url": "https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/"
    },
    {
      "source_name": "Socket Shai-Hulud November 2025",
      "url": "https://socket.dev/blog/shai-hulud-strikes-again-v2"
    },
    {
      "source_name": "Socket Shai-Hulud Trufflehog September 2025",
      "url": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
    }
  ]
}