Unverified60% confidenceFactExact time
Shai-Hulud is the codename for a class of self-propagating npm attacks, with its name taken from the giant sandworm in the Dune series
2
Sources
60%
Confidence
Long-term
Relevance
8/7/2026
First Seen
Sources
Related Claims
UnverifiedShai-Hulud 攻击的核心特征是蠕虫式扩散：窃取维护者凭证后向其维护的多个包注入恶意代码，并利用窃取的更多凭证横向传播69% similarUnverifiedNPM worms (such as Shai-Hulud) propagate by compromising one package, stealing other NPM publish tokens, and then using those tokens to publish more malicious packages in a snowball-style spread.67% similarUnverifiedShai-Hulud 攻击载荷通过 postinstall 等生命周期脚本扫描本地敏感信息，包括 npm 令牌、AWS/GCP/Azure 云凭证、环境变量密码及 CI/CD 部署密钥64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/704132API
curl https://kongchang.com/api/v1/knowledge/claims/704132MCP
get_claim(id=704132)