Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by moh_quz on Sunday December 14, 2025 @05:34AM (#46262127)

Really appreciate the transparency here. Post-mortems like this are vital for the industry.

I'm curious was the exfiltration traffic distinguishable from normal developer traffic?

We've been looking into stricter egress filtering for our dev environments, but it's always a battle between security and breaking npm install

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by robinhoodexe on Sunday December 14, 2025 @09:27AM (#46263242)

Wouldn’t the IP allowlist feature on the GitHub organisation work wonders for this kind of attack?

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by moh_quz on Monday December 15, 2025 @04:16AM (#46272097)

That definitely helps, but I don't think it solves the compromised machine scenario.

If the attacker has shell access to the dev's laptop, they are likely just running commands directly from that machine (or proxying through it). So to GitHub, the traffic still looks like it's coming from the allowed IP.

Allowlists are mostly for stopping usage of a token that got stolen and taken off-device.

[ Parent | on HN ]