# Shai-Hulud Goes Open Source

DevFeed: [Shai-Hulud Goes Open Source](<https://devfeed.tech/articles/shai-hulud-goes-open-source-8298.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/>)

Author: Ryan Simon, Sebastian Obregoso, Greg Foss

Published: 2026-05-13T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Open Source](<https://devfeed.tech/topics/open-source.md>), [Code](<https://devfeed.tech/topics/code.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>), [Bun](<https://devfeed.tech/topics/bun.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [ssh](<https://devfeed.tech/topics/ssh.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [c2](<https://devfeed.tech/tags/c2.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [code](<https://devfeed.tech/tags/code.md>), [framework](<https://devfeed.tech/tags/framework.md>), [github](<https://devfeed.tech/tags/github.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [macos](<https://devfeed.tech/tags/macos.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [teampcp](<https://devfeed.tech/tags/teampcp.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

## AI overview

A static analysis of the Shai-Hulud offensive framework attributed to TeamPCP. The article examines its TypeScript/Bun architecture, credential harvesting, supply-chain poisoning, CI/CD targeting, persistence, and encrypted data exfiltration.

## Source excerpt

A static analysis of the open-sourced Shai-Hulud offensive framework attributed to TeamPCP, covering its credential harvesting, supply chain poisoning, and exfiltration capabilities.