Mini Shai-Hulud has scraped runner process memory to extract short-lived identity tokens, which it then exchanged for per-package npm trusted-publisher tokens.7
tool
Mini Shai-Hulud S9043
- Type
- malware
- Platforms
- Containers, IaaS, Linux, macOS, SaaS, Windows
- Created
- 29 July 2026
- Last modified
- 31 July 2026
Mini Shai-Hulud is a credential stealer and self-replicating supply chain worm, derived from Shai-Hulud, that has been used by TeamPCP to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. Mini Shai-Hulud can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. Mini Shai-Hulud also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.[1][2][3][4][5][6]
55
TechniquesTop 1%
12
TacticsTop 1%
1
Threat groupunranked
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S9043
Mini Shai-Hulud has established Fallback Channels to exfiltrate data to Github when other configured infrastructure is found to be unreachable.891011
Mini Shai-Hulud has discovered network configuration through the use of system commands to include ip addr, and ip route.12
Mini Shai-Hulud has accessed and propagated to AWS EC2 instances via SSM Send-Command.13
Mini Shai-Hulud has used a hybrid AES-256-GCM and RSA OAEP-SHA256 encryption to archive gathered data. Mini Shai-Hulud has also utilized custom MD5-keystream XOR cipher to encrypt data.14 Mini Shai-Hulud has also been deployed via an obfuscated script using Bun JavaScript runtime.15
Mini Shai-Hulud has leveraged commands such as whoami to identify the system owner.16
Standing S9043
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques55Top 1%
99th percentile · 99% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
Tactics12Top 1%
100th percentile · None of the 825 ATT&CK software entries has more tactics spanned — the highest in the population.
Threat group161% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique6medBottom 8%
8th percentile · 92% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique3med
Detection coverage S9043
790 distinct rules cover the 55 techniques recorded for this tool. The 860 technique-to-rule mappings resolve to 790 distinct rules, because one rule can cover several techniques. 507 Sigma · 283 Splunk.
48 covered by at least one rule7 with no coverage790 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org