Shai-Hulud campaign
Named by 2 kept items in this workspace.
Search every workspace for Shai-Hulud campaign. It matches the name as written, so it can find other things that share it.
The items that name it 2
high-profile package compromises in the second half of 2025
Earlier version of the campaign; the SAP CAP compromise in late April 2026 used the same lifecycle-hook payload pattern seen in Mini-Shai-Hulud.
All threat actors in this workspace.