TeamPCP_OSS efaf360d05 feat: initial Shai-Hulud credential harvesting and C2 framework ...

Full release of the multi-provider credential harvester targeting CI/CD environments.

Includes eight credential providers (filesystem, shell, GitHub Actions runner, AWS SSM,
AWS Secrets Manager, AWS STS, Kubernetes, HashiCorp Vault) with regex-based pattern
matching across 20+ credential types. Data is encrypted with AES-256-GCM + RSA-OAEP
and exfiltrated via a priority-ordered sender chain (HTTPS C2 domain fallbacking to
public GitHub repository commits with dead-man-switch persistence).

Three supply-chain mutators included: npm OIDC token exchange for OpenSearch-js,
npm token-based package backdooring with preinstall hooks, and GitHub branch injection
targeting VSCode/Claude startup hooks. Build pipeline with string obfuscation, log
stripping, and JavaScript control-flow flattening.

2026-05-11 10:00:00 +00:00

..

build-plugin.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

build.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

decrypt.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

env-scramble.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

obfuscate.js

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

pack-assets.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

scramble-shared.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00

strip-logs.ts

feat: initial Shai-Hulud credential harvesting and C2 framework

2026-05-11 10:00:00 +00:00