- 5th January 2026
Sha1-Hulud V3.0 is not a typical vulnerability — it’s a malicious npm package that executes on install, steals CI and cloud credentials, and weaponizes npm and GitHub tokens to spread further. If it touched your build system, assume compromise.
Francesco Cipollone