v1 → v2
Scores
trust_score2 → 1
severity_base— → —
score_modifier0 → 0
Sections
Incident Overview
unchanged
Scale and Affected Packages
unchanged
Technical Attack Chain → Initial Access: Compromised Employee Credentials
unchanged
Payload Capabilities and Credential Harvesting → Attack Mechanism: GitHub Actions OIDC Abuse and Trusted Publishing
unchanged
Self-Propagation and Dead Man's Switch → Payload: Obfuscation and Credential Harvesting
unchanged
Attribution: TeamPCP and the Mini Shai-Hulud Framework → Self-Propagation, Persistence and Dead Man's Switch
unchanged
Relevance to Crypto Developers and Web3 Build Pipelines → Cryptocurrency and Web3 Risk
unchanged
Indicators of Compromise → Attribution: TeamPCP and the Mini Shai-Hulud Malware Family
unchanged
Remediation Guidance → Indicators of Compromise
unchanged
Broader npm Supply Chain Attack Context (2026) → Red Hat Response and Official Guidance
unchanged
(section 11) → Remediation Guidance
unchanged
(section 12) → Broader npm Supply Chain Context (2026)
unchanged
Timeline events
+ added2025-09 — (no description)
+ added2026-04 — (no description)
+ added2026-05 — (no description)
- removed2026-04-13 — (no description)
- removed2026-04-22 — (no description)
- removed2026-04-29 — (no description)
- removed2026-04-30 — (no description)
- removed2026-05-12 — (no description)
- removed2026-05-15 — (no description)
- removed2026-05-19 — (no description)
- removed2026-05-20 — (no description)
- removed2026-05-24 — (no description)
- removed2026-05-29 — (no description)
- removed2026-06-03 — (no description)
~ changed2026-06: “” → “”
Accepted submissions
No changes to accepted submissions.
Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: 036a1f659e2d1019837b2851e118bf8f2a4f392b6a599adf2709079b60a7ed5f
v2 hash: 6787d32b34c32371e89fcebe47d84d22460d2d1955126cb4c936a40e24c28eeb