Mini Shai-Hulud: Supply Chain Malware Attack

**Mini Shai‑Hulud** is a coordinated supply‑chain campaign (attributed to TeamPCP) that poisoned npm and PyPI packages using GitHub Actions cache poisoning and mutable CI workflow triggers to exfiltrate CI/CD, cloud, and developer credentials; attackers deployed persistence daemons and have the capability to run destructive wiper payloads under certain conditions. The report provides immediate remediation guidance (package removal, credential rotation, hunting for persistence artifacts), short‑ and long‑term mitigations for CI/CD and dependency hygiene, and lists artifacts/IOCs and vendor upgrade recommendations.