Publication croisée depuis https://programming.dev/post/41331208

"Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.

The malicious code exfiltrates the stolen information by creating a GitHub Action runner named SHA1HULUD, and a GitHub repository description Sha1-Hulud: The Second Coming.. This suggests it may be the same attacker behind the "Shai-Hulud" attack observed in September 2025.

And now, over 27,000 GitHub repositories were infected."

Other source with list of compromised package available

top 6 comments

sorted by: hot top controversial new old

[-] Cooper8@feddit.online 7 points 1 week ago

What are the implications for users of FOSS? Should we not be downloading from github?

[-] atmorous@lemmy.world 4 points 1 week ago

Every dev should be switching to Forgejo/Codeberg, & possibly Gitlab instead of Github for sure

[-] thatonecoder@lemmy.ca 4 points 1 week ago

NPM should be destroyed, at this point… so many problems come from that place.

[-] 4jVXAfSdzKnV@lemmy.ml 11 points 1 week ago

The Problem is not npm. The same can happen for maven, crates, gomods, and other. The problem is that all of these provide and generated a dependency hell where you implement one dependency for one thing which contains 10 subdependency where each of these dependency contain dependencies again. That the dependency hell which is causing such problems. The problem is not npm, its the mindset of developers.

[-] Jayjader@jlai.lu 2 points 1 week ago

I just searched on GitHub for "Sha1-Hulud: The Second Coming.": 692 repositories. On the first page of results I was able to find a repo clearly made by the malware, and in that repo I was able to find someone's github token with a few applications of "decode from base64".

This is pretty bad. I don't know what exactly comes next, an awareness campaign to get people to clean their infected machines and packages?