Record · corpus.blog/posts/01a07df1-ef52-7079-bdf6-ecb7f5145afb

PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats

PyPI Blog · published 26 November 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.pypi.org Wayback capture

2blogs citing

First cited: 27 Nov 2025
Most recent: 10 Mar 2026
Rank this month: not ranked
Links from this post: 18
Words captured: 443

Cited by

Blog

In the post

Date

bernat.tech

Defense in Depth: A Practical Guide to Python Supply Chain Security Read at the source ↗

10 Mar 2026

Hugo van Kemenade

Setting secrets in env vars Read at the source ↗

27 Nov 2025

Links from this post

Link

Host

https://en.wikipedia.org/wiki/Monorepo

en.wikipedia.org

https://docs.pypi.org/trusted-publishers/

docs.pypi.org

https://crates.io/docs/trusted-publishing

crates.io

https://guides.rubygems.org/trusted-publishing/

guides.rubygems.org

https://docs.npmjs.com/trusted-publishers

docs.npmjs.com

https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments

docs.github.com

https://www.pyopensci.org/blog/python-packaging-security-publish-pypi.html

pyopensci.org

https://docs.zizmor.sh/

docs.zizmor.sh

https://codeql.github.com/

codeql.github.com

https://pypi.org/security/

pypi.org

https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

aikido.dev

https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem

cisa.gov

https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/

securitylabs.datadoghq.com

https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24

helixguard.ai

https://www.reversinglabs.com/blog/shai-hulud-worm-npm

reversinglabs.com

https://socket.dev/blog/shai-hulud-strikes-again-v2

socket.dev

https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised

stepsecurity.io

https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack

wiz.io