Shai-Hulud

Shai-Hulud is a supply-chain worm framework developed by the threat actor cluster UNC6780 (also tracked as TeamPCP) and released as open-source on GitHub on 12 May 2026 under an MIT licence. The release included a $1,000 Monero bounty for the largest attack campaign built on the kit, explicitly incentivising third parties to scale exploitation. Within days, a copycat operation tracked as Megalodon used the framework to poison 5,561 GitHub Actions repositories in six hours. A further variant, Phantom Gyp, emerged on 3 June and extended the evasion surface by targeting the npm binding.gyp native-build step.

The framework automates industrial-scale repository poisoning, injecting malicious payloads into legitimate dependency chains. A particularly significant finding from the Megalodon and Phantom Gyp campaigns was that affected packages carried valid SLSA provenance attestations, demonstrating that cryptographic supply-chain Integrity standards do not guarantee code Integrity when the build pipeline itself is compromised. This challenges a foundational assumption of the SLSA (Supply-chain Levels for Software Artefacts) framework adopted by major cloud providers.

Shai-Hulud's open-sourcing represents a shift in attacker economics: previously, worm frameworks of this sophistication were closely held by state-adjacent actors. Free release under a permissive licence, combined with financial incentives, lowers the barrier for organised criminal groups and script-level actors to mount campaigns that previously required significant capability. Security teams face a sustained wave of Miasma and derivative variants as the ecosystem commoditises.