Shai-Hulud 2.0 Malicious Payload Hashes Detection

Mehulkumar Savajani@Msavajani

•updated Dec 3, 2025•32•0•250

Detects the creation or modification of files with SHA256 hashes known to be associated with the Shai-Hulud 2.0 npm supply chain attack campaign. This rule specifically looks for file creation or renaming events where the SHA256 hash of the file matches a predefined list of malicious hashes.