Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

1 IOC

Shai-Hulud Malware In-Depth Analysis: Open Source Means Loss of Control?

SlowMist

Published May 14, 2026Original Report

Threat Actors

Excerpt

Shai-Hulud is a major cybersecurity threat targeting the open-source software supply chain. It is a self-propagating npm malicious worm that infects the open-source ecosystem. It is considered one of the largest supply chain attacks on npm in recent years, involving hundreds of malicious packages. The SlowMist MistEye threat intelligence system has issued multiple warnings. On May 12, a threat actor group known as TeamPCP made a move that shocked the security community: they…

Read the original report →

Diamond Model

Adversary(1)

Infrastructure

Capability

Victim

Attack Flow8 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1078

1/8

Compromise Accounts

ActionSpread via compromised accounts

Threat actors used compromised GitHub accounts to spread the Shai-Hulud malware.

Indicators of Compromise

Open the mindmap →

1 indicators

Type	Indicator	Confidence	Score	First Seen
SHA1	d446803f4c3bc116263faa3499a1d3f95b2825de	Medium	Score 55/100	First seen Jun 2, 2026

IOC Relationship Graph

Building graph…