Mini Shai-Hulud - OhNoWhatsGoingOn... String in Memory/CommandLine

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.