On September 15, a new supply chain attack was identified that targeted the @ctrl/tinycolor and 150 other NPM packages. The attack scenario was similar to the one used in the s1ngularity and GhostActions campaigns. The threat actors combined a local environment secrets extraction with a malicious GitHub actions workflow

The post Shai-Hulud: A Persistent Secret Leaking Campaign appeared first on Security Boulevard.

Gaëtan Ferry

Source: Security Boulevard
Source Link: https://securityboulevard.com/2025/09/shai-hulud-a-persistent-secret-leaking-campaign/