Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
NPM Compromise: The Wrath of the Shai-Hulud Supply Chain Attack
Malware Families
Excerpt
In September 2025, multiple NPM packages were compromised. Some of the compromised packages were highly popular, with millions of downloads per week. Two different sets of compromises were observed: The first compromise occurred around September 8th, 2025, when the packages were embedded with the ability to replace cryptocurrency wallets with adversary-controlled ones .  The second compromise utilized the Shai-Hulud worm , which was employed to exfiltrate sensitive…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09 | Medium | Score 53/100 | First seen |
| Domain | npmjs.help | High | Score 58/100 | First seen |
| URL | https://webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…