6
Shai-Hulud round 2 on GitHub, massive leaks of data and propagation of stealer (about.gitlab.com)
submitted 11 months ago by to c/opensource@programming.dev
comment fedilink hide all child comments
 

Publication croisée depuis https://programming.dev/post/41331208

"Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.

The malicious code exfiltrates the stolen information by creating a GitHub Action runner named SHA1HULUD, and a GitHub repository description Sha1-Hulud: The Second Coming.. This suggests it may be the same attacker behind the "Shai-Hulud" attack observed in September 2025.

And now, over 27,000 GitHub repositories were infected."

Other source with list of compromised package available

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
7 comments in c/opensource@lemmy.ml view that post
[–] 7 points 11 months ago (2 children)

What are the implications for users of FOSS? Should we not be downloading from github?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] 2 points 11 months ago

    I just searched on GitHub for "Sha1-Hulud: The Second Coming.": 692 repositories. On the first page of results I was able to find a repo clearly made by the malware, and in that repo I was able to find someone's github token with a few applications of "decode from base64".

    This is pretty bad. I don't know what exactly comes next, an awareness campaign to get people to clean their infected machines and packages?

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 11 months ago (1 child)

    NPM should be destroyed, at this point… so many problems come from that place.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • load more comments (-1 replies)
    [–] 1 point 11 months ago

    It's been a busy day..

  • permalink
  • fedilink
  • source
    •
    1 comment in c/security@programming.dev view that post
    [–] 3 points 11 months ago

    Bless the Maker and His water.

  • permalink
  • fedilink
  • source
    •