Multi-phase breakdown of the Shai-Hulud credential harvesting and C2 framework: surface, harvest, exfiltration, propagation, and dead-man-switch persistence.
Referenced in SecurityWeek coverage of the May 2026 TanStack/Mistral/UiPath wave.
Full release of the multi-provider credential harvester targeting CI/CD environments.
Includes eight credential providers (filesystem, shell, GitHub Actions runner, AWS SSM,
AWS Secrets Manager, AWS STS, Kubernetes, HashiCorp Vault) with regex-based pattern
matching across 20+ credential types. Data is encrypted with AES-256-GCM + RSA-OAEP
and exfiltrated via a priority-ordered sender chain (HTTPS C2 domain fallbacking to
public GitHub repository commits with dead-man-switch persistence).
Three supply-chain mutators included: npm OIDC token exchange for OpenSearch-js,
npm token-based package backdooring with preinstall hooks, and GitHub branch injection
targeting VSCode/Claude startup hooks. Build pipeline with string obfuscation, log
stripping, and JavaScript control-flow flattening.
edxeth