Shanhai666 malicious NuGet package sabotage activity
Malware Activity
Summary
Hide ▲
Show ▼
Nine malicious NuGet packages published under shanhai666 were found to contain dormant sabotage code that can disrupt .NET database operations and Siemens S7 PLC communications. The packages mix mostly legitimate functionality with hidden triggers that may activate years after publication. If triggered, the payload can kill the host process or corrupt PLC writes, creating operational risk for software and industrial environments.
Related Happenings
Mini Shai-Hulud npm supply-chain malware wave
Malware Activity
First: 12.05.2026 14:07
Last: 12.05.2026 14:07
Sources 1
About this happening:
The **Sha1-Hulud** npm supply-chain campaign is a fresh **second wave** of **Shai-Hulud**-style activity that has compromised **hundreds of npm packages**. The malware runs during...
Mini Shai-Hulud npm supply-chain malware wave
Malware ActivityAbout this happening: The **Sha1-Hulud** npm supply-chain campaign is a fresh **second wave** of **Shai-Hulud**-style activity that has compromised **hundreds of npm packages**. The malware runs during...
BufferZoneCorp sleeper-package supply chain campaign
Campaign
First: 01.05.2026 12:43
Last: 01.05.2026 12:43
Sources 1
About this happening:
The **BufferZoneCorp** software supply chain campaign is pushing **malicious Ruby gems and Go modules** that can steal credentials, tamper with **GitHub Actions**, and persist on...
BufferZoneCorp sleeper-package supply chain campaign
CampaignAbout this happening: The **BufferZoneCorp** software supply chain campaign is pushing **malicious Ruby gems and Go modules** that can steal credentials, tamper with **GitHub Actions**, and persist on...
Mini Shai-Hulud SAP-related npm supply-chain campaign
Campaign
First: 29.04.2026 19:26
Last: 29.04.2026 19:26
Sources 1
About this happening:
A new **Mini Shai-Hulud** supply-chain campaign is targeting **SAP-related npm packages**, putting **developer and CI/CD environments** at risk of credential theft and malicious p...
Mini Shai-Hulud SAP-related npm supply-chain campaign
CampaignAbout this happening: A new **Mini Shai-Hulud** supply-chain campaign is targeting **SAP-related npm packages**, putting **developer and CI/CD environments** at risk of credential theft and malicious p...
Latest development: 12.05.2026 11:50
Mini Shai-Hulud expands beyond the original SAP-related npm packages to compromise TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and DraftLab packages across npm and PyPI, with malicious payloads using router_init.js, GitHub Actions abuse, and exfiltration to filev2.getsession[.]org, api.masscan[.]cloud, or attacker-controlled GitHub repositories.
Telnyx Python package hit by data theft breach
Incident
First: 27.03.2026 18:53
Last: 27.03.2026 18:53
Sources 1
About this happening:
The **telnyx** Python package was **compromised on PyPI** with **4.87.1** and **4.87.2**, exposing downstream importers to **credential theft** and **data exfiltration**. The mali...
Telnyx Python package hit by data theft breach
IncidentAbout this happening: The **telnyx** Python package was **compromised on PyPI** with **4.87.1** and **4.87.2**, exposing downstream importers to **credential theft** and **data exfiltration**. The mali...
Npm package ecosystem CanisterWorm exploitation wave
Exploitation Wave
First: 23.03.2026 10:31
Last: 23.03.2026 10:31
Sources 1
About this happening:
Attackers expanded the **Trivy** compromise into a **self-propagating CanisterWorm** wave that hit **dozens of npm packages**, creating broad downstream supply-chain risk. The abu...
Npm package ecosystem CanisterWorm exploitation wave
Exploitation WaveAbout this happening: Attackers expanded the **Trivy** compromise into a **self-propagating CanisterWorm** wave that hit **dozens of npm packages**, creating broad downstream supply-chain risk. The abu...
Timeline
-
07.11.2025 22:53 2 articles · 6mo ago
Socket finds shanhai666 malicious NuGet packages with dormant sabotage code
Initial DisclosureNine malicious NuGet packages published under shanhai666 mix mostly legitimate .NET functionality with a hidden C# payload that targets database operations in SQL Server, PostgreSQL, and SQLite, and industrial communications through Sharp7 for Siemens S7 PLCs. The code uses date checks and probabilistic triggers tied to hardcoded trigger dates from August 8, 2027 through November 29, 2028, and Sharp7Extend can also terminate PLC communications or corrupt PLC writes.
Show sources
- Malicious NuGet packages drop disruptive 'time bombs' — www.bleepingcomputer.com — 07.11.2025 22:53
- Malicious NuGet packages drop disruptive 'time bombs' — www.bleepingcomputer.com — 07.11.2025 22:53