NoLimitSecu #534 - Shai-Hulud

Value of the Information & Strength of the Argument

The value of the information is high, as it provides a detailed and technical analysis of a real-world supply chain attack, including specific techniques, examples, and mitigation strategies. The argumentation is solid, supported by the guest’s expertise and references to public reports and tools. The discussion is well-structured, moving from the attack’s background to its technical details and implications. The hosts ask relevant questions that clarify the attack’s mechanics and impact. The episode offers practical advice for developers and organizations to protect themselves, such as using pnpm’s security features and monitoring CI/CD pipelines. The information is presented in an accessible yet technical manner, making it valuable for both security professionals and developers.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is good, as the guest is a recognized expert and the information is consistent with public reports from DataDog, Wiz, and other sources. The sources cited in the description are relevant and provide further reading. The title accurately reflects the content, focusing on the Shai-Hulud worm. The discussion is based on factual events and technical details, with some speculation clearly identified. The episode does not overstate claims and acknowledges uncertainties, such as the attribution of the attack. The sources are of high quality, including official security advisories and analyses from reputable companies. The title is appropriate and does not mislead the audience.

The title accurately reflects the content, focusing on the Shai-Hulud npm worm.

8/10

The episode features a security expert from DataDog discussing a real-world supply chain attack with technical details and references to multiple sources. The information is consistent with public reports and the expert's background adds credibility. However, some claims are based on speculation and the discussion is informal.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction of the guest and topic: Shai-Hulud npm worm.
• 05:00Discussion on the npm ecosystem and why it's a target.
• 10:00Explanation of how the worm spreads via phishing and token theft.
• 15:00Details on exfiltration via public GitHub repositories and making private repos public.
• 20:00Impact on popular packages and companies like CrowdStrike.
• 25:00Introduction of Shai-Hulud 2.0 and its improvements.
• 28:20Mitigation strategies and tools like pnpm and Harden Runner.

• Shai-Hulud 2.0 npm worm - DataDog Security Labs — Primary source for the attack analysis.
• Shai-Hulud 2.0 Indicators of Compromise - DataDog — IOCs for the worm.
• Shai-Hulud 2.0 Aftermath - Wiz Blog — Analysis of the ongoing attack.
• CERTFR-2025-ACT-051 - ANSSI — French CERT advisory on the attack.
• Previous episode on supply chain security - NoLimitSecu — Referenced for background on supply chain security.
• npm author Qix compromised - Socket — Example of a phishing attack on an npm maintainer.
• Example of npm phishing campaign - Bluesky — Example of phishing campaign.
• npm debug and chalk packages compromised - Aikido — Example of compromised packages.
• npm phishing campaign - Mimecast — Example of phishing campaign.
• PoC of npm worm - CERT/CC — Proof of concept for npm worm.
• Building an npm worm - contolini.com — Proof of concept for npm worm.
• npm response to install scripts vulnerability - npm blog — npm's response to the vulnerability.
• GitGuardian hasmysecretleaked — Tool to check if secrets have leaked.
• GitHub's plan for a more secure npm supply chain — GitHub's response and recommendations.
• s1ngularity supply chain attack - Wiz — Related campaign.
• PackageGate: 6 zero-days in JS package managers - Koi — Vulnerability bypassing --ignore-scripts.
• pnpm supply chain security guide — Mitigation strategies including minimumReleaseAge.
• DataDog supply-chain firewall — Tool to protect against supply chain attacks.
• Harden-runner - StepSecurity — Tool for monitoring CI/CD pipelines.

• Shai-Hulud 2.0 npm worm - DataDog Security Labs — Primary source for the attack analysis.
• Shai-Hulud 2.0 Aftermath - Wiz Blog — Analysis of the ongoing attack.
• CERTFR-2025-ACT-051 - ANSSI — French CERT advisory on the attack.