News for hackers. Stuff that matters.

A comment on Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem.

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by h1fra on Sunday December 14, 2025 @01:23PM (#46265401)
We don't have a clear explanation of the destructive behavior, right? It looks like it had no real purpose, and there were much more effective ways of destroying their repos. Very script kiddie-like, which does not really fit the main complexity of the virus. Very surprising.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by n2d4 on Sunday December 14, 2025 @01:33PM (#46265497)
It hides the malware's trail, and disguises which keys were leaked, making rotation harder
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by ack_inc on Monday December 15, 2025 @06:20AM (#46273015)
The socket.dev deconstruction of the worm (https://socket.dev/blog/shai-hulud-strikes-again-v2) suggests that the destructive actions on GitHub were not part of the malware itself.
[ Parent | on HN ]