Publication croisée depuis https://programming.dev/post/41331208
"Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.
The malicious code exfiltrates the stolen information by creating a GitHub Action runner named SHA1HULUD, and a GitHub repository description Sha1-Hulud: The Second Coming… This suggests it may be the same attacker behind the “Shai-Hulud” attack observed in September 2025.
And now, over 27,000 GitHub repositories were infected."
I just searched on GitHub for
"Sha1-Hulud: The Second Coming.": 692 repositories. On the first page of results I was able to find a repo clearly made by the malware, and in that repo I was able to find someone’s github token with a few applications of “decode from base64”.This is pretty bad. I don’t know what exactly comes next, an awareness campaign to get people to clean their infected machines and packages?
It’s been a busy day…
What are the implications for users of FOSS? Should we not be downloading from github?
Every dev should be switching to Forgejo/Codeberg, & possibly Gitlab instead of Github for sure
NPM should be destroyed, at this point… so many problems come from that place.
The Problem is not npm. The same can happen for maven, crates, gomods, and other. The problem is that all of these provide and generated a dependency hell where you implement one dependency for one thing which contains 10 subdependency where each of these dependency contain dependencies again. That the dependency hell which is causing such problems. The problem is not npm, its the mindset of developers.
