SHA1-Hulud
Named by 5 kept items in this workspace.
Search every workspace for SHA1-Hulud. It matches the name as written, so it can find other things that share it.
The items that name it 5
Second wave of the worm, arrived late November 2025, self-described in its exfiltration repositories under this name
Self-propagating campaign whose payload harvested credentials and wrote them out as JSON to newly created public GitHub repositories, using the victim's own GitHub token; destination was github.com, which cannot be blocked by a CI deny list since it must remain allowed.
Parallel attack wave on Nov 24, 2025 hitting Zapier, ENS Domains and others; long-lived credentials found in compromised repos; npm security team recommended Trusted Publishing as the fix.
Worm that hit Zapier, ENS Domains, and other prominent npm packages in November 2025, later detected inside CNCF's Backstage repository.
Hit the npm ecosystem in November 2025; exfiltrated stolen credentials as JSON blobs into new public GitHub repositories named after random UUIDs, over 21,000 of them within hours of initial detection. Caught in practice by Harden-Runner detecting compromised packages running in CNCF's Backstage rep
All threat actors in this workspace.