Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack

Microsoft describes the Shai‑Hulud 2.0 supply-chain campaign in which threat actors modified hundreds of npm packages to run malicious preinstall scripts that install a Bun runtime, deploy GitHub Actions runners named SHA1HULUD, and use tools such as TruffleHog to harvest and exfiltrate credentials; the report provides technical details, detections, hunting queries, mitigation guidance, and indicators to help defenders identify and contain affected assets.