# mini shai hulud

Published articles for mini shai hulud.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign

DevFeed: [The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign](<https://devfeed.tech/articles/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign-13261.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign>)

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [ethereum](<https://devfeed.tech/tags/ethereum.md>), [github](<https://devfeed.tech/tags/github.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [payload](<https://devfeed.tech/tags/payload.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [smart-contract](<https://devfeed.tech/tags/smart-contract.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

The article examines a 2026 npm supply-chain attack in which a compromised maintainer account was used to publish malicious versions of keyv and cacheable-related packages. It reports credential theft, worm-like propagation to hundreds of downstream packages, and command-and-control infrastructure discovered through an Ethereum smart contract. It also explains that Chainguard customers were protected by malware scanning and package cooldowns.

### Source excerpt

The latest npm supply chain attack hit keyv and cacheable. See how Chainguard's malware scanning and cooldowns kept customers protected.

## Chainguard Libraries now available on AWS Security Hub Extended

DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended](<https://devfeed.tech/articles/chainguard-libraries-now-available-on-aws-security-hub-extended-12969.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-libraries-now-available-on-aws-security-hub-extended>)

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [AWS Security Hub](<https://devfeed.tech/topics/aws-security-hub.md>), [Security](<https://devfeed.tech/topics/security.md>), [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [ai-coding](<https://devfeed.tech/tags/ai-coding.md>), [aws-security-hub](<https://devfeed.tech/tags/aws-security-hub.md>), [axios](<https://devfeed.tech/tags/axios.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [java](<https://devfeed.tech/tags/java.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [litellm](<https://devfeed.tech/tags/litellm.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [python](<https://devfeed.tech/tags/python.md>), [redhat](<https://devfeed.tech/tags/redhat.md>), [redhat-cloud-services](<https://devfeed.tech/tags/redhat-cloud-services.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-attack](<https://devfeed.tech/tags/software-supply-chain-attack.md>), [telnyx](<https://devfeed.tech/tags/telnyx.md>)

### AI overview

Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks.

### Source excerpt

Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads.

## Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads

DevFeed: [Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads](<https://devfeed.tech/articles/chainguard-customers-safe-from-mini-shai-hulud-worm-targeting-redhat-cloud-services-npm-packages-with-100k-weekly-downloads-12938.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-customers-safe-from-mini-shai-hulud-worm-targeting-redhat-cloud-services-npm-packages>)

Published: 2026-06-01T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [obfuscation](<https://devfeed.tech/topics/obfuscation.md>), [payload](<https://devfeed.tech/topics/payload.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>)

Tags: [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [endpoint-security](<https://devfeed.tech/tags/endpoint-security.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [obfuscation](<https://devfeed.tech/tags/obfuscation.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [packages](<https://devfeed.tech/tags/packages.md>), [payload](<https://devfeed.tech/tags/payload.md>), [red-hat](<https://devfeed.tech/tags/red-hat.md>), [redhat-cloud-services](<https://devfeed.tech/tags/redhat-cloud-services.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

The article reports that the Mini Shai-Hulud worm compromised more than 90 @redhat-cloud-services npm packages through a hijacked GitHub account and GitHub Actions OIDC trusted publishing. The worm spreads tampered packages and malicious workflows, executes an obfuscated payload during installation, and steals cloud, Vault, GitHub, npm, and CI credentials. Chainguard customers using Chainguard Libraries for JavaScript and Chainguard Actions were unaffected.

### Source excerpt

A new npm worm hit 90+ Red Hat packages. Chainguard customers stayed protected by blocking install-time scripts and hardening CI/CD workflows.

## Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026)

DevFeed: [Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026)](<https://devfeed.tech/articles/mini-shai-hulud-npm-attack-antv-ecosystem-compromise-may-2026-13160.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mini-shai-hulud-npm-attack-antv-ecosystem-compromise-may-2026>)

Published: 2026-05-19T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Data visualization](<https://devfeed.tech/topics/data-visualization.md>), [Aeternum](<https://devfeed.tech/topics/aeternum.md>), [stripe](<https://devfeed.tech/topics/stripe.md>), [Raycast extension](<https://devfeed.tech/topics/raycast-extension.md>), [React UI animations](<https://devfeed.tech/topics/react-ui-animations.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [antv](<https://devfeed.tech/tags/antv.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-npm](<https://devfeed.tech/tags/chainguard-npm.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [react](<https://devfeed.tech/tags/react.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

### AI overview

The article reports that a compromised npm maintainer account pushed malicious versions of 314 packages in Alibaba's AntV ecosystem on May 19, 2026. It describes the Mini Shai-Hulud campaign, which uses install hooks and obfuscated Bun scripts to deliver malware and harvest developer credentials.

### Source excerpt

The Mini Shai-Hulud npm worm compromised 314 packages in the AntV ecosystem on May 19, 2026 -- including echarts-for-react and timeago.js.

## Luck isn't a security control: What happened with mini Shai-Hulud and what you need to do

DevFeed: [Luck isn't a security control: What happened with mini Shai-Hulud and what you need to do](<https://devfeed.tech/articles/luck-isn-t-a-security-control-what-happened-with-mini-shai-hulud-and-what-you-need-to-do-13141.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/luck-isnt-a-security-control-what-happened-with-mini-shai-hulud-and-what-you-need-to-do>)

Published: 2026-05-13T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm](<https://devfeed.tech/topics/npm.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [ai-coding-agents](<https://devfeed.tech/tags/ai-coding-agents.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [packages](<https://devfeed.tech/tags/packages.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

This article examines the mini Shai-Hulud supply chain worm, which affected more than 400 packages. It argues that malicious code can enter during package build and distribution without a CVE, and that teams should strengthen preventive security across registries, GitHub Actions, CI/CD pipelines, dependencies, AI coding agents, and configuration files.

### Source excerpt

A new supply chain worm hit 400+ packages. Learn why preventive security, not reactive patching, is the only way to stop the next attack.

## Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads

DevFeed: [Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads](<https://devfeed.tech/articles/chainguard-artifacts-safe-from-npm-supply-chain-attack-targeting-sap-developer-dependencies-with-2-25m-monthly-downloads-12929.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-npm-supply-chain-attack-targeting-sap-developer-dependencies>)

Published: 2026-04-29T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [npm](<https://devfeed.tech/topics/npm.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Bun](<https://devfeed.tech/topics/bun.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>)

Tags: [bun](<https://devfeed.tech/tags/bun.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [github](<https://devfeed.tech/tags/github.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [sap](<https://devfeed.tech/tags/sap.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

A Shai-Hulud-style npm supply-chain attack compromised four SAP Cloud Application Programming Model dependencies with more than 2.25 million combined monthly downloads. The malicious packages used a preinstall hook to download Bun and harvest GitHub tokens, npm tokens, and other developer secrets. Chainguard customers were protected because Chainguard Libraries for JavaScript does not build or serve packages containing install-time scripts, and Chainguard Factory terminated rebuilds when it detected the hook.

### Source excerpt

New npm worm targets 2.25M-download packages. Chainguard customers stayed protected by blocking install-time scripts and malicious dependencies.