v1 → v2
Scores
trust_score0 → 0
severity_base— → —
score_modifier-12 → -12
Sections
Campaign Overview and Attribution
unchanged
Original Shai-Hulud Worm (September 2025)
unchanged
Shai-Hulud 2.0 (November–December 2025) and Microsoft Guidance → Shai-Hulud 2.0 (November-December 2025) and Microsoft Guidance
unchanged
Trust Wallet Chrome Extension Hack (December 24–26, 2025) → Trust Wallet Chrome Extension Hack (December 24-26, 2025)
unchanged
Shai-Hulud 3.0 "The Golden Path" (December 28, 2025) → Shai-Hulud 3.0 "The Golden Path" (December 2025)
unchanged
Bitwarden CLI Compromise and Checkmarx Breach (April 22, 2026) → Bitwarden CLI Compromise and Checkmarx Breach (April 2026)
unchanged
Mini Shai-Hulud Wave 1: SAP Ecosystem (April 29, 2026) → Mini Shai-Hulud Wave 1: SAP Ecosystem and PyTorch Lightning (April 2026)
unchanged
Mini Shai-Hulud Wave 2: TanStack, Mistral AI, UiPath (May 11–12, 2026) → Mini Shai-Hulud Wave 2: TanStack, Mistral AI, UiPath (May 2026)
unchanged
Open-Sourcing of the Shai-Hulud Worm (May 12–13, 2026) → Self-Propagation and SLSA Provenance Bypass
unchanged
Mini Shai-Hulud Wave 3: AntV Ecosystem (May 19, 2026) → Downstream Compromises: OpenAI and GitHub
unchanged
Vect Ransomware Partnership and Enterprise Victim Claims → Open-Sourcing of the Shai-Hulud Worm (May 2026)
unchanged
Technical Attack Mechanism and Indicators of Compromise → Mini Shai-Hulud Wave 3: AntV / atool Maintainer Compromise (May 2026)
unchanged
Broader Crypto Targeting → Red Hat Miasma Variant (June 2026)
unchanged
Copycat Threat and Ongoing Risk (May–June 2026) → Hades PyPI Variant and Cumulative Ecosystem Impact
unchanged
(section 15) → Related Campaign: Mastra AI Compromise Attributed to North Korea (June 2026)
unchanged
(section 16) → Ransomware Partnership, Extortion and Enterprise Victim Claims
unchanged
(section 17) → Cryptocurrency and Wallet Targeting
unchanged
(section 18) → Credential Harvesting, Persistence and Dead-Man's Switch
unchanged
(section 19) → Technical Attack Mechanism and Indicators of Compromise
unchanged
(section 20) → Copycat Threat and Ongoing Risk
unchanged
(section 21) → Mitigation and Remediation
unchanged
Timeline events
+ added2025-11 — (no description)
+ added2025-12 — (no description)
+ added2026-03 — (no description)
+ added2026-04 — (no description)
+ added2026-05 — (no description)
- removed2025-11-24 — (no description)
- removed2025-12-08 — (no description)
- removed2025-12-09 — (no description)
- removed2025-12-24 — (no description)
- removed2025-12-25 — (no description)
- removed2025-12-26 — (no description)
- removed2025-12-28 — (no description)
- removed2026-04-22 — (no description)
- removed2026-04-29 — (no description)
- removed2026-05-11 — (no description)
- removed2026-05-12 — (no description)
- removed2026-05-19 — (no description)
~ changed2025-09: “” → “”
~ changed2026-06: “” → “”
Accepted submissions
No changes to accepted submissions.
Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: 42705ac81f52dbed31bae9934510a3787b7117ed1890dcad16386e13c04ce3f9
v2 hash: ada1a256a5c18355ee0fdc837c912f642a258f8e69a0a62df0bf583e9ba19ae0