Sigma rule: Shai-Hulud 2.0 Malicious NPM Package Installation
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-49ab5485ac05, updated 2025-11-28T00:00:00.000Z.
Rule
- Title
- Shai-Hulud 2.0 Malicious NPM Package Installation
- Status
- experimental
- Level
- high
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems)
- Date
- 2025-11-28
- File
- rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_npm_package_installation.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Log source
- product
- windows
- category
- process_creation
Detection
selection_img:
Image|endswith: '\node.exe'
CommandLine|contains:
- 'install'
- ' i '
# List of known malicious packages and versions from the Shai-Hulud 2.0 campaign
selection_packages:
CommandLine|contains:
- '[email protected]'
- '@accordproject/[email protected]'
- '@accordproject/[email protected]'
- '@accordproject/[email protected]'
- '@accordproject/[email protected]'
- '@accordproject/[email protected]'
- '@accordproject/[email protected]'
- '@accordproject/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@actbase/[email protected]'
- '@afetcan/[email protected]'
- '@afetcan/[email protected]'
- '@alaan/[email protected]'
- '@alexadark/[email protected]'
- '@alexadark/[email protected]'
- '@alexadark/[email protected]'
- '@alexadark/[email protected]'
- '@alexcolls/[email protected]'
- '@alexcolls/[email protected]'
- '@alexcolls/[email protected]'
- '@alexcolls/[email protected]'
- '@antstackio/[email protected]'
- '@antstackio/[email protected]'
- '@antstackio/[email protected]'
- '@antstackio/[email protected]'
- '@antstackio/[email protected]'
- '@aryanhussain/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@asyncapi/[email protected]'
- '@bdkinc/[email protected]'
- '@browserbasehq/[email protected]'
- '@browserbasehq/[email protected]'
- '@browserbasehq/[email protected]'
- '@browserbasehq/[email protected]'
- '@browserbasehq/[email protected]'
- '@browserbasehq/[email protected]'
- '@browserbasehq/[email protected]'
- '@caretive/[email protected]'
- '@chtijs/[email protected]'
- '@clausehq/[email protected]'
- '@clausehq/[email protected]'
- '@clausehq/[email protected]'
- '@clausehq/[email protected]'
- '@clausehq/[email protected]'
- '@cllbk/[email protected]'
- '@commute/[email protected]'
- '@commute/[email protected]'
- '@commute/[email protected]'
- '@dev-blinq/[email protected]'
- '@dev-blinq/[email protected]'
- '@dev-blinq/[email protected]'
- '@dev-blinq/[email protected]'
- '@dev-blinq/[email protected]'
- '@elsedev/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@ensdomains/[email protected]'
- '@everreal/[email protected]'
- '@everreal/[email protected]'
- '@everreal/[email protected]'
- '@everreal/[email protected]'
- '@everreal/[email protected]'
- '@everreal/[email protected]'
- '@faq-component/[email protected]'
- '@faq-component/[email protected]'
- '@fishingbooker/[email protected]'
- '@fishingbooker/[email protected]'
- '@fishingbooker/[email protected]'
- '@fishingbooker/[email protected]'
- '@fishingbooker/[email protected]'
- '@hapheus/[email protected]'
- '@hover-design/[email protected]'
- '@hover-design/[email protected]'
- '@huntersofbook/[email protected]'
- '@huntersofbook/[email protected]'
- '@huntersofbook/[email protected]'
- '@huntersofbook/[email protected]'
- '@huntersofbook/[email protected]'
- '@huntersofbook/[email protected]'
- '@hyperlook/[email protected]'
- '@ifelsedeveloper/[email protected]'
- '@ifelsedeveloper/[email protected]'
- '@ifings/[email protected]'
- '@ifings/[email protected]'
- '@jayeshsadhwani/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@kvytech/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@lessondesk/[email protected]'
- '@livecms/[email protected]'
- '@livecms/[email protected]'
- '@lokeswari-satyanarayanan/[email protected]'
- '@louisle2/[email protected]'
- '@louisle2/[email protected]'
- '@lpdjs/[email protected]'
- '@lui-ui/[email protected]'
- '@lui-ui/[email protected]'
- '@lui-ui/[email protected]'
- '@markvivanco/[email protected]'
- '@markvivanco/[email protected]'
- '@mcp-use/[email protected]'
- '@mcp-use/[email protected]'
- '@mcp-use/[email protected]'
- '@mcp-use/[email protected]'
- '@mcp-use/[email protected]'
- '@mcp-use/[email protected]'
- '@micado-digital/[email protected]'
- '@mizzle-dev/[email protected]'
- '@mparpaillon/[email protected]'
- '@mparpaillon/[email protected]'
- '@mparpaillon/[email protected]'
- '@ntnx/[email protected]'
- '@ntnx/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@oku-ui/[email protected]'
- '@orbitgtbelgium/[email protected]'
- '@orbitgtbelgium/[email protected]'
- '@orbitgtbelgium/[email protected]'
- '@orbitgtbelgium/[email protected]'
- '@osmanekrem/[email protected]'
- '@osmanekrem/[email protected]'
- '@pergel/[email protected]'
- '@pergel/[email protected]'
- '@pergel/[email protected]'
- '@pergel/[email protected]'
- '@pergel/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@posthog/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@postman/[email protected]'
- '@pradhumngautam/[email protected]'
- '@productdevbook/[email protected]'
- '@productdevbook/[email protected]'
- '@productdevbook/[email protected]'
- '@productdevbook/[email protected]'
- '@productdevbook/[email protected]'
- '@pruthvi21/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@quick-start-soft/[email protected]'
- '@relyt/[email protected]'
- '@relyt/[email protected]'
- '@relyt/[email protected]'
- '@sameepsi/[email protected]'
- '@sameepsi/[email protected]'
- '@seezo/[email protected]'
- '@seung-ju/[email protected]'
- '@seung-ju/[email protected]'
- '@seung-ju/[email protected]'
- '@seung-ju/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@silgi/[email protected]'
- '@sme-ui/[email protected]'
- '@strapbuild/[email protected]'
- '@strapbuild/[email protected]'
- '@strapbuild/[email protected]'
- '@strapbuild/[email protected]'
- '@suraj_h/[email protected]'
- '@thedelta/[email protected]'
- '@tiaanduplessis/[email protected]'
- '@tiaanduplessis/[email protected]'
- '@tiaanduplessis/[email protected]'
- '@tiaanduplessis/[email protected]'
- '@trackstar/[email protected]'
- '@trackstar/[email protected]'
- '@trackstar/[email protected]'
- '@trackstar/[email protected]'
- '@trackstar/[email protected]'
- '@trefox/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trigo/[email protected]'
- '@trpc-rate-limiter/[email protected]'
- '@trpc-rate-limiter/[email protected]'
- '@varsityvibe/[email protected]'
- '@varsityvibe/[email protected]'
- '@varsityvibe/[email protected]'
- '@varsityvibe/[email protected]'
- '@varsityvibe/[email protected]'
- '@viapip/[email protected]'
- '@vishadtyagi/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@voiceflow/[email protected]'
- '@vucod/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '@zapier/[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
- '[email protected]'
condition: all of selection_*False positives (as the rule lists them)
- Unknown
Tags
- attack.initial-access
- attack.execution
- attack.t1195.002
- detection.emerging-threats
MITRE ATT&CK ids this rule names
Related rules
References
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_npm_package_installation.yml
Sources and licences
SigmaHQ
"Shai-Hulud 2.0 Malicious NPM Package Installation" by Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_npm_package_installation.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Shai-Hulud 2.0 Malicious NPM Package Installation",
entity page, dataset version ref-49ab5485ac05, updated 2025-11-28T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/bae7c70b-8569-44e9-accf-b30073da8a5d (accessed 2026-11-03).
Underlying source: SigmaHQ rule bae7c70b-8569-44e9-accf-b30073da8a5d, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.