Mini Shai-Hulud Supply-Chain Attack C2 Network Activity

Georgios Maragos@Gmarak

•updated May 12, 2026•20•3•1,811

Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack. This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.