MEDIUMSupply Chain
Global

Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

·Source: Sonatype (Maven/npm)

Updated:

Executive Summary

<img src="https://www.sonatype.com/hubfs/1-2025_Website-Assets/2025_blog_images/RapidResponse-shai-hulud-may.jpg" alt="Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target" class="hs-featured-image" style="width:auto !import

Analysis

Why bother hunting for a CVE when you can just publish malicious code straight into the software supply chain? That’s the story behind the latest wave of Shai-Hulud-related npm compromises, which recently hit the Ant Design (AntV) ecosystem and potentially exposed downstream developers to credential theft and remote code execution through trusted packages. Again.

Indicators of Compromise (4)

URL (3)
https://www.sonatype.com/blog/shai-hulud-is-back-maintainers-the-target
VirusTotalURLhaus
https://www.sonatype.com/hubfs/1-2025_Website-Assets/2025_blog_images/RapidResponse-shai-hulud-may.jpg
VirusTotalURLhaus
https://www.sonatype.com/blog/the-second-coming-of-shai-hulud-attackers-innovating-on-npm
VirusTotalURLhaus
Domain (1)
www.sonatype.com
VirusTotalURLhaus
Source Attribution

Originally published by Sonatype (Maven/npm) on May 19, 2026.

Related Threats

LOWSupply Chain

Why some security fixes never reach your vulnerability dashboard

On April 22, for roughly 90 minutes, a malicious version of Bitwarden CLI appeared on npm. Version 2026.4.0 contained a credential-stealing payload that executed an obfuscated loader and harvested AWS, Azure, GCP, GitHub, and npm tokens from any developer machine that ran npm install . The attackers reached Bitwarden’s npm publishing path through a compromised GitHub Action related to the Checkmar

CVE-2026-42994CVE-2020-10148
CSO Online
MEDIUMSupply Chain

Grafana GitHub Breach Exposes Source Code via TanStack npm Attack

Grafana Labs, on May 19, 2026, said an investigation into its recent breach found no evidence of customer production systems or operations being compromised. It said the scope of the incident is limited to the Grafana Labs GitHub environment, which includes public and private source code along with internal GitHub repositories. "After the initial assessment, we found that in addition to source

The Hacker News
MEDIUMSupply Chain

The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised

A day after the AntV npm supply chain attack, the same campaign appears to have struck `durabletask`, a Microsoft-associated Python package on PyPI. Snyk has coverage in the vulnerability database and package health pages. Here's what we know.

Snyk