Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Graph the Planet: Shai-Hulud 2.0
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: This blog looks at the Shai-Hulud 2.0 worm through an Attack Path Management lens. I also introduce NPMHound which can be used to visualize NPM package dependencies in BloodHound OpenGraph.
Introduction
A recent supply chain attack, referred to as Shai-Hulud 2.0, involved an attacker using a worm to infect developer systems that contained credentials for various technology platforms. The underlying secrets were exfiltrated to a network of public GitHub repositories. Presumably, the attacker (or new attackers) retrieved these secrets. At a high level, this is depicted in the following graph.
Decomposing Edges
I wanted to better understand the initial infection. That is, I wanted to decompose the “StartsInitialInfection” edge.
PostHog was one organization this campaign targeted. They have provided a detailed postmortem here. In their case, the infection started with a PWN request. This was noted in the analysis performed by Wiz in a blog here. Attackers can use PWN requests to have their malicious code run using GitHub workflows. The malicious code can be crafted to expose credentials available in the runner environment. A screenshot of a commit that abused this configuration is provided below. This led to the environment variables being sent to a webhook that the attacker controlled.
The environment variables included a GitHub personal access token (PAT) for one of PostHog’s bots. This bot identity had broad repository write permissions across their GitHub organization per the post mortem. Let’s pause to graph some of what has been discussed so far.
PostHog …