Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Return of Shai-Hulud: The “Second Coming” of the NPM Supply Chain Compromise
Threat Actors
Malware Families
Excerpt
💡 For our previous blog on Shai-Hulud, please click here . 💡 Artifacts from this blog are available within our GitHub Repository . On November 24, 2025, multiple security vendors reported a new Shai-Hulud campaign that compromised several popular npm packages. The compromised packages include those from Zapier, ENS Domains, PostHog, and Postman. Researchers from Wiz identified that the earliest evidence of malicious npm packages being added to npm is from…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | f834301562964d4eba8eb58e8204315f | Medium | Score 53/100 | First seen |
| SHA1 | 16f766887ffda24e6cf41bbb3d900ada4aa1d881 | Medium | Score 53/100 | First seen |
| SHA256 | dde38c953e6fe119ebde4be3321ee547038ec555c4e9e5e9cc30b9a309a59383 | Medium | Score 53/100 | First seen |
| SHA1 | 5595cbd56d1df1f15d859f5535d5c157f26b81df | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…