Shai-Hulud (PyPI)

Attribution basis

These are the signal classes linking the members of this campaign — the broad evidence categories we use to attribute a package, not the raw indicators themselves.

• shared malware fingerprint
• OSV advisory cluster

Sample attributed packages

• lintro@0.93.1
• claude-mpm@6.5.83
• myk-pi-tools@3.16.3
• lintro@0.93.0
• lintro@0.92.0
• lintro@0.91.59
• lintro@0.91.58
• lintro@0.91.57
• harbor@0.20.1.dev202607270303
• evo-cli@0.18.0
• urllib3-future@2.24.900
• lintro@0.91.56
• claude-mpm@6.5.82
• lintro@0.91.55
• lintro@0.91.54
• lintro@0.91.53
• lintro@0.91.52
• lintro@0.91.51
• lintro@0.91.50
• lintro@0.91.49
• harbor@0.20.1.dev202607260135
• lintro@0.91.48
• evo-cli@0.17.0
• evo-cli@0.16.1
• evo-cli@0.16.0
• evo-cli@0.15.6
• lintro@0.91.47
• pdd-cli@0.0.309
• bernstein@3.10.0
• agent-security-harness@4.10.0

PkgRadar attributes coordinated supply-chain campaigns and blocks their packages at the CI gate. Start free or see all tracked campaigns.