Shai-Hulud V2 Supply Chain Attack Detection

Aamir Muhammad@Aamir

•updated Mar 25, 2026•8•1•329

This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.