Shai-Hulud NPM Attack GitHub Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 19, 2025•4•0•106

Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.