Shai-Hulud 2.0: the supply chain attack that learned
· Source: blog.gitguardian.com
In short
The Shai-Hulud supply chain attack has evolved into a new campaign called 'The Second Coming' that targets NPM packages and GitHub repositories. The threat actors have improved their tactics by exfiltrating CI/CD secrets directly to GitHub repositories created with stolen credentials, rather than using public endpoints that can be rate-limited. This sophisticated attack has compromised 621 NPM packages and exposed thousands of secrets from both developer workstations and CI/CD pipelines.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 48, 2025: Agentic AI Revolutionizes Supply Chains with Real-Time Control and Resilience
Tags: security, supply-chain, cybersecurity, secrets, automation, ci-cd