u/sbahra

After all the coverage this got, we were curious to see how attackers were actually exploiting this in the wild! So we deployed a few production instances with our security platform turned on.

We found a new Mini Shai-Hulud variant that makes the worm a general Linux post-exploitation payload and continues through with Github and NPM propagation.