this post was submitted on 25 Nov 2025
9 points (90.9% liked)

GitHub

259 readers
1 users here now

A community for discussion and posts relating to github https://github.com/

founded 2 years ago
MODERATORS
 

"Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.

The malicious code exfiltrates the stolen information by creating a GitHub Action runner named SHA1HULUD, and a GitHub repository description Sha1-Hulud: The Second Coming.. This suggests it may be the same attacker behind the "Shai-Hulud" attack observed in September 2025.

And now, over 27,000 GitHub repositories were infected."

Other source with list of compromised package available

no comments (yet)
sorted by: hot top controversial new old
there doesn't seem to be anything here