As cited
Copy frozen at (site build).
threat intel
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion
The Shai-Hulud supply chain attack campaign evolved significantly between November 2025 and June 2026, expanding from npm into Python Package Index (PyPI), shifting from maintainer compromise to CI/CD and identifier token abuse, and introducing prompt injection techniques to evade artificial intelligence (AI)-based security scanners. Early waves attributed to TeamPCP (tracked as UNC6780) were followed by copycat activity after the worm source code was publicly released under an MIT license on May 12, 2026. The campaign systematically targeted trust layers including maintainer authentication, package installation, security tooling, provenance verification, OIDC publishing workflows, IDE configuration files, and AI analysis pipelines.
Why it matters: Software development teams and security operations using npm, PyPI, GitHub Actions, and AI-based package scanning must immediately audit dependencies for malicious packages from affected namespaces (TanStack, @antv, LiteLLM, and others), enforce package lockfiles, restrict CI/CD secret access to non-fork contexts, implement phishing-resistant multifactor authentication (MFA), isolate system prompts in AI scanning tools, and treat absence of a scanner verdict as a security signal rather than a pass.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion
The Shai-Hulud supply chain attack campaign evolved significantly between November 2025 and June 2026, expanding from npm into Python Package Index (PyPI), shifting from maintainer compromise to CI/CD and identifier token abuse, and introducing prompt injection techniques to evade artificial intelligence (AI)-based security scanners. Early waves attributed to TeamPCP (tracked as UNC6780) were followed by copycat activity after the worm source code was publicly released under an MIT license on May 12, 2026. The campaign systematically targeted trust layers including maintainer authentication, package installation, security tooling, provenance verification, OIDC publishing workflows, IDE configuration files, and AI analysis pipelines.
Why it matters: Software development teams and security operations using npm, PyPI, GitHub Actions, and AI-based package scanning must immediately audit dependencies for malicious packages from affected namespaces (TanStack, @antv, LiteLLM, and others), enforce package lockfiles, restrict CI/CD secret access to non-fork contexts, implement phishing-resistant multifactor authentication (MFA), isolate system prompts in AI scanning tools, and treat absence of a scanner verdict as a security signal rather than a pass.
- Source published
- First seen by Cybersecurity Tracker