Skip to content
Threat Feed
Subscribe

Product

VS Code

4 briefs RSS
high advisory

Shai-Hulud Campaign Activity

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

jscrambler 8.14.0 +90 campaign shai-hulud
25i updated
high advisory

Microsoft Security Updates — July 2026

Roundup of Microsoft security advisories published in July 2026.

PoC PowerShell +511 roundup
11c 354i updated
critical threat

Shai-Hulud Malware Used in Supply Chain Attack via Compromised npm Packages

The Shai-Hulud malware was used in a large-scale software supply-chain attack compromising hundreds of packages across open-source software ecosystems by compromising developer secrets and CI/CD pipelines.

router +11 TeamPCP supply-chain supply-chain-attack npm pypi credential-theft shai-hulud
3r 7t 3i
medium advisory

Suspicious Execution from VS Code Extension

Malicious VS Code extensions can execute arbitrary commands, leading to initial access and subsequent payload deployment on Windows systems.

VS Code initial-access execution supply-chain-compromise vscode
2r 9t