v1 → v2
Scores
trust_score0 → 1
severity_base— → —
score_modifier0 → 0
Sections
Attack Overview
unchanged
Phantom Gyp Technique: Technical Analysis → Preceding Wave: @redhat-cloud-services Compromise (June 1, 2026)
unchanged
Credential Harvesting and CI/CD Targeting → Phantom Gyp Technique
unchanged
Self-Propagation: Worm Mechanics → Payload Architecture and Obfuscation
unchanged
Affected Packages and Download Exposure → Credential Harvesting Scope
unchanged
Vapi.ai Incident Response → Self-Propagation: Worm Mechanics
unchanged
Broader Miasma/Shai-Hulud Campaign Context → Persistence and AI Coding Assistant Backdoors
unchanged
Relevance to Crypto and Web3 Developers → Exfiltration and C2 Infrastructure
unchanged
Detection Indicators and Remediation → Affected Packages and Download Exposure
unchanged
Attribution and Threat Actor Assessment → Vapi.ai Incident Response
unchanged
(section 11) → Industry Response and Mitigations
unchanged
(section 12) → Broader Miasma/Shai-Hulud Campaign Context
unchanged
(section 13) → Attribution and Threat Actor Assessment
unchanged
(section 14) → Relevance to Crypto and Web3 Developers
unchanged
(section 15) → Detection Indicators and Remediation
unchanged
Timeline events
+ added2026-05 — (no description)
- removed2026-05-12 — (no description)
- removed2026-06-03 — (no description)
- removed2026-06-04 — (no description)
- removed2026-06-05 — (no description)
~ changed2025-09: “” → “”
~ changed2026-06: “” → “”
Accepted submissions
No changes to accepted submissions.
Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: 249ae2efc9d28f989e60a34b84950d6de61656dd2a2626d7c07d835123c69d27
v2 hash: 9a52bb509bda63afb3769bbf2741b5d0648bc08a1e948fb301c7cec7427c9e62