Shai-Hulud rebuilt as a standalone stealer

This report describes a campaign that delivered a new standalone Shai-Hulud credential-stealing worm (compiled with Bun) via React2Shell RCE on Next.js servers; the operator also deployed an SSH lateral-worm and persistent access (attacker SSH keys and Global Socket). The standalone binary collects wide-ranging credentials (GitHub, AWS, Kubernetes, Vault, CI runner secrets), propagates through GitHub repositories and npm packages, and exfiltrates results to an attacker-controlled collector; the report provides IOCs, build artifact details, and hunting guidance.