Widespread Mini Shai-Hulud Campaign Is a Matter of Trust - DevOps.com

"“Shai-Hulud should be understood less as a one-off package compromise and more as an evolving supply-chain playbook,” said Jonathan Stross, SAP security analyst at Pathlock."

"Earlier waves of Shai-Hulud attacks in 2025 and this year focused on stealing developer and maintainer credentials and using them to publish more malicious packages. In the latest incidents - referred to as “Mini Shai-Hulud” - the threat group abused trusted CI/CD publishing paths and OpenID Connect (OIDC) tokens, meaning that malicious package versions still carried valid provenance attestations."

"“In other words, some of the signals defenders increasingly rely on to establish trust were present, even though the package content was malicious,” Stross said."

"“Modern attacks increasingly exploit trust rather than simply targeting vulnerabilities,” Randolph said. “Whether it is software ecosystems, digital identities, or interconnected platforms, adversaries are learning to weaponize trusted relationships to gain speed, scale, and operational access.”"

Shai-Hulud incidents emphasize threats to software developers and CI/CD pipelines as attackers increasingly target DevOps environments. The TeamPCP group’s latest activity reflects a shift toward abusing trust across connected corporate ecosystems and development platforms. Earlier waves focused on stealing developer and maintainer credentials and using them to publish malicious packages. The newer “Mini Shai-Hulud” incidents use trusted CI/CD publishing paths and OpenID Connect (OIDC) tokens so malicious package versions still include valid provenance attestations. This means trust signals used by defenders can appear legitimate even when package content is malicious. Organizations are urged to recognize campaigns that build on identity abuse and to prepare for attacks that exploit trusted relationships for speed, scale, and operational access.

Read at DevOps.com