Linux Process Creation: npm installs known Shai-Hulud 2.0 malicious packages and versions

Alerts on Linux npm install commands referencing known Shai-Hulud 2.0 malicious package versions.

FreeUnreviewedSigmahighv1
title: "Linux Process Creation: npm installs known Shai-Hulud 2.0 malicious packages and versions"
id: 48219773-ce54-44a1-94a7-3c2a27cd4be8
related:
  - id: bae7c70b-8569-44e9-accf-b30073da8a5d
    type: similar
  - id: 514f533b-f56e-421d-80b0-f7706a3e9d23
    type: derived
status: experimental
description: This rule flags Linux process executions where npm is used to install a specific list of package names and exact versions tied to the Shai-Hulud 2.0 supply chain campaign. The behavior matters because installing attacker-controlled npm packages enables malicious code to enter the build environment and downstream software. Detection relies on process creation telemetry, matching the command line for both the installer intent and the presence of known malicious package@version strings in the npm command.
references:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_malicious_npm_package_installation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-28
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1195.002
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: \node
    CommandLine|contains:
      - install
      - " i "
  selection_packages:
    CommandLine|contains:
      - 02-echo@0.0.7
      - "@accordproject/concerto-analysis@3.24.1"
      - "@accordproject/concerto-linter@3.24.1"
      - "@accordproject/concerto-linter-default-ruleset@3.24.1"
      - "@accordproject/concerto-metamodel@3.12.5"
      - "@accordproject/concerto-types@3.24.1"
      - "@accordproject/markdown-it-cicero@0.16.26"
      - "@accordproject/template-engine@2.7.2"
      - "@actbase/css-to-react-native-transform@1.0.3"
      - "@actbase/native@0.1.32"
      - "@actbase/node-server@1.1.19"
      - "@actbase/react-absolute@0.8.3"
      - "@actbase/react-daum-postcode@1.0.5"
      - "@actbase/react-kakaosdk@0.9.27"
      - "@actbase/react-native-actionsheet@1.0.3"
      - "@actbase/react-native-devtools@0.1.3"
      - "@actbase/react-native-fast-image@8.5.13"
      - "@actbase/react-native-kakao-channel@1.0.2"
      - "@actbase/react-native-kakao-navi@2.0.4"
      - "@actbase/react-native-less-transformer@1.0.6"
      - "@actbase/react-native-naver-login@1.0.1"
      - "@actbase/react-native-simple-video@1.0.13"
      - "@actbase/react-native-tiktok@1.1.3"
      - "@afetcan/api@0.0.13"
      - "@afetcan/storage@0.0.27"
      - "@alaan/s2s-auth@2.0.3"
      - "@alexadark/amadeus-api@1.0.4"
      - "@alexadark/gatsby-theme-events@1.0.1"
      - "@alexadark/gatsby-theme-wordpress-blog@2.0.1"
      - "@alexadark/reusable-functions@1.5.1"
      - "@alexcolls/nuxt-socket.io@0.0.7"
      - "@alexcolls/nuxt-socket.io@0.0.8"
      - "@alexcolls/nuxt-ux@0.6.1"
      - "@alexcolls/nuxt-ux@0.6.2"
      - "@antstackio/eslint-config-antstack@0.0.3"
      - "@antstackio/express-graphql-proxy@0.2.8"
      - "@antstackio/graphql-body-parser@0.1.1"
      - "@antstackio/json-to-graphql@1.0.3"
      - "@antstackio/shelbysam@1.1.7"
      - "@aryanhussain/my-angular-lib@0.0.23"
      - "@asyncapi/avro-schema-parser@3.0.25"
      - "@asyncapi/avro-schema-parser@3.0.26"
      - "@asyncapi/bundler@0.6.5"
      - "@asyncapi/bundler@0.6.6"
      - "@asyncapi/cli@4.1.2"
      - "@asyncapi/cli@4.1.3"
      - "@asyncapi/converter@1.6.3"
      - "@asyncapi/converter@1.6.4"
      - "@asyncapi/diff@0.5.1"
      - "@asyncapi/diff@0.5.2"
      - "@asyncapi/dotnet-rabbitmq-template@1.0.1"
      - "@asyncapi/dotnet-rabbitmq-template@1.0.2"
      - "@asyncapi/edavisualiser@1.2.1"
      - "@asyncapi/edavisualiser@1.2.2"
      - "@asyncapi/generator-components@0.3.2"
      - "@asyncapi/generator-components@0.3.3"
      - "@asyncapi/generator-react-sdk@1.1.4"
      - "@asyncapi/generator-react-sdk@1.1.5"
      - "@asyncapi/generator@2.8.5"
      - "@asyncapi/generator@2.8.6"
      - "@asyncapi/go-watermill-template@0.2.76"
      - "@asyncapi/go-watermill-template@0.2.77"
      - "@asyncapi/html-template@3.3.2"
      - "@asyncapi/html-template@3.3.3"
      - "@asyncapi/java-spring-cloud-stream-template@0.13.5"
      - "@asyncapi/java-spring-cloud-stream-template@0.13.6"
      - "@asyncapi/java-spring-template@1.6.1"
      - "@asyncapi/java-spring-template@1.6.2"
      - "@asyncapi/java-template@0.3.5"
      - "@asyncapi/java-template@0.3.6"
      - "@asyncapi/keeper@0.0.2"
      - "@asyncapi/keeper@0.0.3"
      - "@asyncapi/markdown-template@1.6.8"
      - "@asyncapi/markdown-template@1.6.9"
      - "@asyncapi/modelina-cli@5.10.2"
      - "@asyncapi/modelina-cli@5.10.3"
      - "@asyncapi/modelina@5.10.2"
      - "@asyncapi/modelina@5.10.3"
      - "@asyncapi/multi-parser@2.2.1"
      - "@asyncapi/multi-parser@2.2.2"
      - "@asyncapi/nodejs-template@3.0.5"
      - "@asyncapi/nodejs-template@3.0.6"
      - "@asyncapi/nodejs-ws-template@0.10.1"
      - "@asyncapi/nodejs-ws-template@0.10.2"
      - "@asyncapi/nunjucks-filters@2.1.1"
      - "@asyncapi/nunjucks-filters@2.1.2"
      - "@asyncapi/openapi-schema-parser@3.0.25"
      - "@asyncapi/openapi-schema-parser@3.0.26"
      - "@asyncapi/optimizer@1.0.5"
      - "@asyncapi/optimizer@1.0.6"
      - "@asyncapi/parser@3.4.1"
      - "@asyncapi/parser@3.4.2"
      - "@asyncapi/php-template@0.1.1"
      - "@asyncapi/php-template@0.1.2"
      - "@asyncapi/problem@1.0.1"
      - "@asyncapi/problem@1.0.2"
      - "@asyncapi/protobuf-schema-parser@3.5.2"
      - "@asyncapi/protobuf-schema-parser@3.5.3"
      - "@asyncapi/protobuf-schema-parser@3.6.1"
      - "@asyncapi/python-paho-template@0.2.14"
      - "@asyncapi/python-paho-template@0.2.15"
      - "@asyncapi/react-component@2.6.6"
      - "@asyncapi/react-component@2.6.7"
      - "@asyncapi/server-api@0.16.24"
      - "@asyncapi/server-api@0.16.25"
      - "@asyncapi/specs@6.10.1"
      - "@asyncapi/specs@6.8.2"
      - "@asyncapi/specs@6.8.3"
      - "@asyncapi/specs@6.9.1"
      - "@asyncapi/studio@1.0.2"
      - "@asyncapi/studio@1.0.3"
      - "@asyncapi/web-component@2.6.6"
      - "@asyncapi/web-component@2.6.7"
      - "@bdkinc/knex-ibmi@0.5.7"
      - "@browserbasehq/bb9@1.2.21"
      - "@browserbasehq/director-ai@1.0.3"
      - "@browserbasehq/mcp-server-browserbase@2.4.2"
      - "@browserbasehq/mcp@2.1.1"
      - "@browserbasehq/sdk-functions@0.0.4"
      - "@browserbasehq/stagehand-docs@1.0.1"
      - "@browserbasehq/stagehand@3.0.4"
      - "@caretive/caret-cli@0.0.2"
      - "@chtijs/eslint-config@1.0.1"
      - "@clausehq/flows-step-httprequest@0.1.14"
      - "@clausehq/flows-step-jsontoxml@0.1.14"
      - "@clausehq/flows-step-mqtt@0.1.14"
      - "@clausehq/flows-step-sendgridemail@0.1.14"
      - "@clausehq/flows-step-taskscreateurl@0.1.14"
      - "@cllbk/ghl@1.3.1"
      - "@commute/bloom@1.0.3"
      - "@commute/market-data-chartjs@2.3.1"
      - "@commute/market-data@1.0.2"
      - "@dev-blinq/ai-qa-logic@1.0.19"
      - "@dev-blinq/blinqioclient@1.0.21"
      - "@dev-blinq/cucumber-js@1.0.131"
      - "@dev-blinq/cucumber_client@1.0.738"
      - "@dev-blinq/ui-systems@1.0.93"
      - "@elsedev/react-csr-sdk@0.2.2"
      - "@ensdomains/address-encoder@1.1.5"
      - "@ensdomains/blacklist@1.0.1"
      - "@ensdomains/buffer@0.1.2"
      - "@ensdomains/ccip-read-cf-worker@0.0.4"
      - "@ensdomains/ccip-read-dns-gateway@0.1.1"
      - "@ensdomains/ccip-read-router@0.0.7"
      - "@ensdomains/ccip-read-worker-viem@0.0.4"
      - "@ensdomains/content-hash@3.0.1"
      - "@ensdomains/curvearithmetics@1.0.1"
      - "@ensdomains/cypress-metamask@1.2.1"
      - "@ensdomains/dnsprovejs@0.5.3"
      - "@ensdomains/dnssec-oracle-anchors@0.0.2"
      - "@ensdomains/dnssecoraclejs@0.2.9"
      - "@ensdomains/durin-middleware@0.0.2"
      - "@ensdomains/durin@0.1.2"
      - "@ensdomains/ens-archived-contracts@0.0.3"
      - "@ensdomains/ens-avatar@1.0.4"
      - "@ensdomains/ens-contracts@1.6.1"
      - "@ensdomains/ens-test-env@1.0.2"
      - "@ensdomains/ens-validation@0.1.1"
      - "@ensdomains/ensjs-react@0.0.5"
      - "@ensdomains/ensjs@4.0.3"
      - "@ensdomains/eth-ens-namehash@2.0.16"
      - "@ensdomains/hackathon-registrar@1.0.5"
      - "@ensdomains/hardhat-chai-matchers-viem@0.1.15"
      - "@ensdomains/hardhat-toolbox-viem-extended@0.0.6"
      - "@ensdomains/mock@2.1.52"
      - "@ensdomains/name-wrapper@1.0.1"
      - "@ensdomains/offchain-resolver-contracts@0.2.2"
      - "@ensdomains/op-resolver-contracts@0.0.2"
      - "@ensdomains/react-ens-address@0.0.32"
      - "@ensdomains/renewal-widget@0.1.10"
      - "@ensdomains/renewal@0.0.13"
      - "@ensdomains/reverse-records@1.0.1"
      - "@ensdomains/server-analytics@0.0.2"
      - "@ensdomains/solsha1@0.0.4"
      - "@ensdomains/subdomain-registrar@0.2.4"
      - "@ensdomains/test-utils@1.3.1"
      - "@ensdomains/thorin@0.6.51"
      - "@ensdomains/ui@3.4.6"
      - "@ensdomains/unicode-confusables@0.1.1"
      - "@ensdomains/unruggable-gateways@0.0.3"
      - "@ensdomains/vite-plugin-i18next-loader@4.0.4"
      - "@ensdomains/web3modal@1.10.2"
      - "@everreal/react-charts@2.0.1"
      - "@everreal/react-charts@2.0.2"
      - "@everreal/validate-esmoduleinterop-imports@1.4.4"
      - "@everreal/validate-esmoduleinterop-imports@1.4.5"
      - "@everreal/web-analytics@0.0.1"
      - "@everreal/web-analytics@0.0.2"
      - "@faq-component/core@0.0.4"
      - "@faq-component/react@1.0.1"
      - "@fishingbooker/browser-sync-plugin@1.0.5"
      - "@fishingbooker/react-loader@1.0.7"
      - "@fishingbooker/react-pagination@2.0.6"
      - "@fishingbooker/react-raty@2.0.1"
      - "@fishingbooker/react-swiper@0.1.5"
      - "@hapheus/n8n-nodes-pgp@1.5.1"
      - "@hover-design/core@0.0.1"
      - "@hover-design/react@0.2.1"
      - "@huntersofbook/auth-vue@0.4.2"
      - "@huntersofbook/core-nuxt@0.4.2"
      - "@huntersofbook/core@0.5.1"
      - "@huntersofbook/form-naiveui@0.5.1"
      - "@huntersofbook/i18n@0.8.2"
      - "@huntersofbook/ui@0.5.1"
      - "@hyperlook/telemetry-sdk@1.0.19"
      - "@ifelsedeveloper/protocol-contracts-svm-idl@0.1.2"
      - "@ifelsedeveloper/protocol-contracts-svm-idl@0.1.3"
      - "@ifings/design-system@4.9.2"
      - "@ifings/metatron3@0.1.5"
      - "@jayeshsadhwani/telemetry-sdk@1.0.14"
      - "@kvytech/cli@0.0.7"
      - "@kvytech/components@0.0.2"
      - "@kvytech/habbit-e2e-test@0.0.2"
      - "@kvytech/medusa-plugin-announcement@0.0.8"
      - "@kvytech/medusa-plugin-management@0.0.5"
      - "@kvytech/medusa-plugin-newsletter@0.0.5"
      - "@kvytech/medusa-plugin-product-reviews@0.0.9"
      - "@kvytech/medusa-plugin-promotion@0.0.2"
      - "@kvytech/web@0.0.2"
      - "@lessondesk/api-client@9.12.2"
      - "@lessondesk/api-client@9.12.3"
      - "@lessondesk/babel-preset@1.0.1"
      - "@lessondesk/electron-group-api-client@1.0.3"
      - "@lessondesk/eslint-config@1.4.2"
      - "@lessondesk/material-icons@1.0.3"
      - "@lessondesk/react-table-context@2.0.4"
      - "@lessondesk/schoolbus@5.2.2"
      - "@lessondesk/schoolbus@5.2.3"
      - "@livecms/live-edit@0.0.32"
      - "@livecms/nuxt-live-edit@1.9.2"
      - "@lokeswari-satyanarayanan/rn-zustand-expo-template@1.0.9"
      - "@louisle2/core@1.0.1"
      - "@louisle2/cortex-js@0.1.6"
      - "@lpdjs/firestore-repo-service@1.0.1"
      - "@lui-ui/lui-nuxt@0.1.1"
      - "@lui-ui/lui-tailwindcss@0.1.2"
      - "@lui-ui/lui-vue@1.0.13"
      - "@markvivanco/app-version-checker@1.0.1"
      - "@markvivanco/app-version-checker@1.0.2"
      - "@mcp-use/cli@2.2.6"
      - "@mcp-use/cli@2.2.7"
      - "@mcp-use/inspector@0.6.2"
      - "@mcp-use/inspector@0.6.3"
      - "@mcp-use/mcp-use@1.0.1"
      - "@mcp-use/mcp-use@1.0.2"
      - "@micado-digital/stadtmarketing-kufstein-external@1.9.1"
      - "@mizzle-dev/orm@0.0.2"
      - "@mparpaillon/connector-parse@1.0.1"
      - "@mparpaillon/imagesloaded@4.1.2"
      - "@mparpaillon/page@1.0.1"
      - "@ntnx/passport-wso2@0.0.3"
      - "@ntnx/t@0.0.101"
      - "@oku-ui/accordion@0.6.2"
      - "@oku-ui/alert-dialog@0.6.2"
      - "@oku-ui/arrow@0.6.2"
      - "@oku-ui/aspect-ratio@0.6.2"
      - "@oku-ui/avatar@0.6.2"
      - "@oku-ui/checkbox@0.6.3"
      - "@oku-ui/collapsible@0.6.2"
      - "@oku-ui/collection@0.6.2"
      - "@oku-ui/dialog@0.6.2"
      - "@oku-ui/direction@0.6.2"
      - "@oku-ui/dismissable-layer@0.6.2"
      - "@oku-ui/focus-guards@0.6.2"
      - "@oku-ui/focus-scope@0.6.2"
      - "@oku-ui/hover-card@0.6.2"
      - "@oku-ui/label@0.6.2"
      - "@oku-ui/menu@0.6.2"
      - "@oku-ui/motion-nuxt@0.2.2"
      - "@oku-ui/motion@0.4.4"
      - "@oku-ui/popover@0.6.2"
      - "@oku-ui/popper@0.6.2"
      - "@oku-ui/portal@0.6.2"
      - "@oku-ui/presence@0.6.2"
      - "@oku-ui/primitive@0.6.2"
      - "@oku-ui/primitives-nuxt@0.3.1"
      - "@oku-ui/primitives@0.7.9"
      - "@oku-ui/progress@0.6.2"
      - "@oku-ui/provide@0.6.2"
      - "@oku-ui/radio-group@0.6.2"
      - "@oku-ui/roving-focus@0.6.2"
      - "@oku-ui/scroll-area@0.6.2"
      - "@oku-ui/separator@0.6.2"
      - "@oku-ui/slider@0.6.2"
      - "@oku-ui/slot@0.6.2"
      - "@oku-ui/switch@0.6.2"
      - "@oku-ui/tabs@0.6.2"
      - "@oku-ui/toast@0.6.2"
      - "@oku-ui/toggle-group@0.6.2"
      - "@oku-ui/toggle@0.6.2"
      - "@oku-ui/toolbar@0.6.2"
      - "@oku-ui/tooltip@0.6.2"
      - "@oku-ui/use-composable@0.6.2"
      - "@oku-ui/utils@0.6.2"
      - "@oku-ui/visually-hidden@0.6.2"
      - "@orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode@2.0.5"
      - "@orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode@1.1.1"
      - "@orbitgtbelgium/orbit-components@1.2.9"
      - "@orbitgtbelgium/time-slider@1.0.187"
      - "@osmanekrem/bmad@1.0.6"
      - "@osmanekrem/error-handler@1.2.2"
      - "@pergel/cli@0.11.1"
      - "@pergel/module-box@0.6.1"
      - "@pergel/module-graphql@0.6.1"
      - "@pergel/module-ui@0.0.9"
      - "@pergel/nuxt@0.25.5"
      - "@posthog/agent@1.24.1"
      - "@posthog/ai@7.1.2"
      - "@posthog/automatic-cohorts-plugin@0.0.8"
      - "@posthog/bitbucket-release-tracker@0.0.8"
      - "@posthog/cli@0.5.15"
      - "@posthog/clickhouse@1.7.1"
      - "@posthog/core@1.5.6"
      - "@posthog/currency-normalization-plugin@0.0.8"
      - "@posthog/customerio-plugin@0.0.8"
      - "@posthog/databricks-plugin@0.0.8"
      - "@posthog/drop-events-on-property-plugin@0.0.8"
      - "@posthog/event-sequence-timer-plugin@0.0.8"
      - "@posthog/filter-out-plugin@0.0.8"
      - "@posthog/first-time-event-tracker@0.0.8"
      - "@posthog/geoip-plugin@0.0.8"
      - "@posthog/github-release-tracking-plugin@0.0.8"
      - "@posthog/gitub-star-sync-plugin@0.0.8"
      - "@posthog/heartbeat-plugin@0.0.8"
      - "@posthog/hedgehog-mode@0.0.42"
      - "@posthog/icons@0.36.1"
      - "@posthog/ingestion-alert-plugin@0.0.8"
      - "@posthog/intercom-plugin@0.0.8"
      - "@posthog/kinesis-plugin@0.0.8"
      - "@posthog/laudspeaker-plugin@0.0.8"
      - "@posthog/lemon-ui@0.0.1"
      - "@posthog/maxmind-plugin@0.1.6"
      - "@posthog/migrator3000-plugin@0.0.8"
      - "@posthog/netdata-event-processing@0.0.8"
      - "@posthog/nextjs-config@1.5.1"
      - "@posthog/nextjs@0.0.3"
      - "@posthog/nuxt@1.2.9"
      - "@posthog/pagerduty-plugin@0.0.8"
      - "@posthog/piscina@3.2.1"
      - "@posthog/plugin-contrib@0.0.6"
      - "@posthog/plugin-server@1.10.8"
      - "@posthog/plugin-unduplicates@0.0.8"
      - "@posthog/postgres-plugin@0.0.8"
      - "@posthog/react-rrweb-player@1.1.4"
      - "@posthog/rrdom@0.0.31"
      - "@posthog/rrweb-player@0.0.31"
      - "@posthog/rrweb-record@0.0.31"
      - "@posthog/rrweb-replay@0.0.19"
      - "@posthog/rrweb-snapshot@0.0.31"
      - "@posthog/rrweb-utils@0.0.31"
      - "@posthog/rrweb@0.0.31"
      - "@posthog/sendgrid-plugin@0.0.8"
      - "@posthog/siphash@1.1.2"
      - "@posthog/snowflake-export-plugin@0.0.8"
      - "@posthog/taxonomy-plugin@0.0.8"
      - "@posthog/twilio-plugin@0.0.8"
      - "@posthog/twitter-followers-plugin@0.0.8"
      - "@posthog/url-normalizer-plugin@0.0.8"
      - "@posthog/variance-plugin@0.0.8"
      - "@posthog/web-dev-server@1.0.5"
      - "@posthog/wizard@1.18.1"
      - "@posthog/zendesk-plugin@0.0.8"
      - "@postman/aether-icons@2.23.2"
      - "@postman/aether-icons@2.23.3"
      - "@postman/aether-icons@2.23.4"
      - "@postman/csv-parse@4.0.3"
      - "@postman/csv-parse@4.0.4"
      - "@postman/csv-parse@4.0.5"
      - "@postman/final-node-keytar@7.9.1"
      - "@postman/final-node-keytar@7.9.2"
      - "@postman/final-node-keytar@7.9.3"
      - "@postman/mcp-ui-client@5.5.1"
      - "@postman/mcp-ui-client@5.5.2"
      - "@postman/mcp-ui-client@5.5.3"
      - "@postman/node-keytar@7.9.4"
      - "@postman/node-keytar@7.9.5"
      - "@postman/node-keytar@7.9.6"
      - "@postman/pm-bin-linux-x64@1.24.3"
      - "@postman/pm-bin-linux-x64@1.24.4"
      - "@postman/pm-bin-linux-x64@1.24.5"
      - "@postman/pm-bin-macos-arm64@1.24.3"
      - "@postman/pm-bin-macos-arm64@1.24.4"
      - "@postman/pm-bin-macos-arm64@1.24.5"
      - "@postman/pm-bin-macos-x64@1.24.3"
      - "@postman/pm-bin-macos-x64@1.24.4"
      - "@postman/pm-bin-macos-x64@1.24.5"
      - "@postman/pm-bin-windows-x64@1.24.3"
      - "@postman/pm-bin-windows-x64@1.24.4"
      - "@postman/pm-bin-windows-x64@1.24.5"
      - "@postman/postman-collection-fork@4.3.3"
      - "@postman/postman-collection-fork@4.3.4"
      - "@postman/postman-collection-fork@4.3.5"
      - "@postman/postman-mcp-cli@1.0.3"
      - "@postman/postman-mcp-cli@1.0.4"
      - "@postman/postman-mcp-cli@1.0.5"
      - "@postman/postman-mcp-server@2.4.10"
      - "@postman/postman-mcp-server@2.4.11"
      - "@postman/postman-mcp-server@2.4.12"
      - "@postman/pretty-ms@6.1.1"
      - "@postman/pretty-ms@6.1.2"
      - "@postman/pretty-ms@6.1.3"
      - "@postman/secret-scanner-wasm@2.1.2"
      - "@postman/secret-scanner-wasm@2.1.3"
      - "@postman/secret-scanner-wasm@2.1.4"
      - "@postman/tunnel-agent@0.6.5"
      - "@postman/tunnel-agent@0.6.6"
      - "@postman/tunnel-agent@0.6.7"
      - "@postman/wdio-allure-reporter@0.0.7"
      - "@postman/wdio-allure-reporter@0.0.8"
      - "@postman/wdio-allure-reporter@0.0.9"
      - "@postman/wdio-junit-reporter@0.0.4"
      - "@postman/wdio-junit-reporter@0.0.5"
      - "@postman/wdio-junit-reporter@0.0.6"
      - "@pradhumngautam/common-app@1.0.2"
      - "@productdevbook/animejs-vue@0.2.1"
      - "@productdevbook/auth@0.2.2"
      - "@productdevbook/chatwoot@2.0.1"
      - "@productdevbook/motion@1.0.4"
      - "@productdevbook/ts-i18n@1.4.2"
      - "@pruthvi21/use-debounce@1.0.3"
      - "@quick-start-soft/quick-document-translator@1.4.2511142126"
      - "@quick-start-soft/quick-git-clean-markdown@1.4.2511142126"
      - "@quick-start-soft/quick-markdown-compose@1.4.2506300029"
      - "@quick-start-soft/quick-markdown-image@1.4.2511142126"
      - "@quick-start-soft/quick-markdown-print@1.4.2511142126"
      - "@quick-start-soft/quick-markdown-translator@1.4.2509202331"
      - "@quick-start-soft/quick-markdown@1.4.2511142126"
      - "@quick-start-soft/quick-remove-image-background@1.4.2511142126"
      - "@quick-start-soft/quick-task-refine@1.4.2511142126"
      - "@relyt/claude-context-core@0.1.1"
      - "@relyt/claude-context-mcp@0.1.1"
      - "@relyt/mcp-server-relytone@0.0.3"
      - "@sameepsi/sor2@2.0.2"
      - "@sameepsi/sor@1.0.3"
      - "@seezo/sdr-mcp-server@0.0.5"
      - "@seung-ju/next@0.0.2"
      - "@seung-ju/openapi-generator@0.0.4"
      - "@seung-ju/react-hooks@0.0.2"
      - "@seung-ju/react-native-action-sheet@0.2.1"
      - "@silgi/better-auth@0.8.1"
      - "@silgi/drizzle@0.8.4"
      - "@silgi/ecosystem@0.7.6"
      - "@silgi/graphql@0.7.15"
      - "@silgi/module-builder@0.8.8"
      - "@silgi/openapi@0.7.4"
      - "@silgi/permission@0.6.8"
      - "@silgi/ratelimit@0.2.1"
      - "@silgi/scalar@0.6.2"
      - "@silgi/yoga@0.7.1"
      - "@sme-ui/aoma-vevasound-metadata-lib@0.1.3"
      - "@strapbuild/react-native-date-time-picker@2.0.4"
      - "@strapbuild/react-native-perspective-image-cropper-2@0.4.7"
      - "@strapbuild/react-native-perspective-image-cropper-poojan31@0.4.6"
      - "@strapbuild/react-native-perspective-image-cropper@0.4.15"
      - "@suraj_h/medium-common@1.0.5"
      - "@thedelta/eslint-config@1.0.2"
      - "@tiaanduplessis/json@2.0.2"
      - "@tiaanduplessis/json@2.0.3"
      - "@tiaanduplessis/react-progressbar@1.0.1"
      - "@tiaanduplessis/react-progressbar@1.0.2"
      - "@trackstar/angular-trackstar-link@1.0.2"
      - "@trackstar/react-trackstar-link-upgrade@1.1.10"
      - "@trackstar/react-trackstar-link@2.0.21"
      - "@trackstar/test-angular-package@0.0.9"
      - "@trackstar/test-package@1.1.5"
      - "@trefox/sleekshop-js@0.1.6"
      - "@trigo/atrix-acl@4.0.2"
      - "@trigo/atrix-elasticsearch@2.0.1"
      - "@trigo/atrix-mongoose@1.0.2"
      - "@trigo/atrix-orientdb@1.0.2"
      - "@trigo/atrix-postgres@1.0.3"
      - "@trigo/atrix-pubsub@4.0.3"
      - "@trigo/atrix-redis@1.0.2"
      - "@trigo/atrix-soap@1.0.2"
      - "@trigo/atrix-swagger@3.0.1"
      - "@trigo/atrix@7.0.1"
      - "@trigo/bool-expressions@4.1.3"
      - "@trigo/eslint-config-trigo@3.3.1"
      - "@trigo/fsm@3.4.2"
      - "@trigo/hapi-auth-signedlink@1.3.1"
      - "@trigo/jsdt@0.2.1"
      - "@trigo/keycloak-api@1.3.1"
      - "@trigo/node-soap@0.5.4"
      - "@trigo/pathfinder-ui-css@0.1.1"
      - "@trigo/trigo-hapijs@5.0.1"
      - "@trpc-rate-limiter/cloudflare@0.1.4"
      - "@trpc-rate-limiter/hono@0.1.4"
      - "@varsityvibe/api-client@1.3.36"
      - "@varsityvibe/api-client@1.3.37"
      - "@varsityvibe/utils@5.0.6"
      - "@varsityvibe/validation-schemas@0.6.7"
      - "@varsityvibe/validation-schemas@0.6.8"
      - "@viapip/eslint-config@0.2.4"
      - "@vishadtyagi/full-year-calendar@0.1.11"
      - "@voiceflow/alexa-types@2.15.60"
      - "@voiceflow/alexa-types@2.15.61"
      - "@voiceflow/anthropic@0.4.4"
      - "@voiceflow/anthropic@0.4.5"
      - "@voiceflow/api-sdk@3.28.58"
      - "@voiceflow/api-sdk@3.28.59"
      - "@voiceflow/backend-utils@5.0.1"
      - "@voiceflow/backend-utils@5.0.2"
      - "@voiceflow/base-types@2.136.2"
      - "@voiceflow/base-types@2.136.3"
      - "@voiceflow/body-parser@1.21.2"
      - "@voiceflow/body-parser@1.21.3"
      - "@voiceflow/chat-types@2.14.58"
      - "@voiceflow/chat-types@2.14.59"
      - "@voiceflow/circleci-config-sdk-orb-import@0.2.1"
      - "@voiceflow/circleci-config-sdk-orb-import@0.2.2"
      - "@voiceflow/commitlint-config@2.6.1"
      - "@voiceflow/commitlint-config@2.6.2"
      - "@voiceflow/common@8.9.1"
      - "@voiceflow/common@8.9.2"
      - "@voiceflow/default-prompt-wrappers@1.7.3"
      - "@voiceflow/default-prompt-wrappers@1.7.4"
      - "@voiceflow/dependency-cruiser-config@1.8.11"
      - "@voiceflow/dependency-cruiser-config@1.8.12"
      - "@voiceflow/dtos-interact@1.40.1"
      - "@voiceflow/dtos-interact@1.40.2"
      - "@voiceflow/encryption@0.3.2"
      - "@voiceflow/encryption@0.3.3"
      - "@voiceflow/eslint-config@7.16.4"
      - "@voiceflow/eslint-config@7.16.5"
      - "@voiceflow/eslint-plugin@1.6.1"
      - "@voiceflow/eslint-plugin@1.6.2"
      - "@voiceflow/exception@1.10.1"
      - "@voiceflow/exception@1.10.2"
      - "@voiceflow/fetch@1.11.1"
      - "@voiceflow/fetch@1.11.2"
      - "@voiceflow/general-types@3.2.22"
      - "@voiceflow/general-types@3.2.23"
      - "@voiceflow/git-branch-check@1.4.3"
      - "@voiceflow/git-branch-check@1.4.4"
      - "@voiceflow/google-dfes-types@2.17.12"
      - "@voiceflow/google-dfes-types@2.17.13"
      - "@voiceflow/google-types@2.21.12"
      - "@voiceflow/google-types@2.21.13"
      - "@voiceflow/husky-config@1.3.1"
      - "@voiceflow/husky-config@1.3.2"
      - "@voiceflow/logger@2.4.2"
      - "@voiceflow/logger@2.4.3"
      - "@voiceflow/metrics@1.5.1"
      - "@voiceflow/metrics@1.5.2"
      - "@voiceflow/natural-language-commander@0.5.2"
      - "@voiceflow/natural-language-commander@0.5.3"
      - "@voiceflow/nestjs-common@2.75.2"
      - "@voiceflow/nestjs-common@2.75.3"
      - "@voiceflow/nestjs-mongodb@1.3.1"
      - "@voiceflow/nestjs-mongodb@1.3.2"
      - "@voiceflow/nestjs-rate-limit@1.3.2"
      - "@voiceflow/nestjs-rate-limit@1.3.3"
      - "@voiceflow/nestjs-redis@1.3.1"
      - "@voiceflow/nestjs-redis@1.3.2"
      - "@voiceflow/nestjs-timeout@1.3.1"
      - "@voiceflow/nestjs-timeout@1.3.2"
      - "@voiceflow/npm-package-json-lint-config@1.1.1"
      - "@voiceflow/npm-package-json-lint-config@1.1.2"
      - "@voiceflow/openai@3.2.2"
      - "@voiceflow/openai@3.2.3"
      - "@voiceflow/pino-pretty@4.4.1"
      - "@voiceflow/pino-pretty@4.4.2"
      - "@voiceflow/pino@6.11.3"
      - "@voiceflow/pino@6.11.4"
      - "@voiceflow/prettier-config@1.10.1"
      - "@voiceflow/prettier-config@1.10.2"
      - "@voiceflow/react-chat@1.65.3"
      - "@voiceflow/react-chat@1.65.4"
      - "@voiceflow/runtime-client-js@1.17.2"
      - "@voiceflow/runtime-client-js@1.17.3"
      - "@voiceflow/runtime@1.29.1"
      - "@voiceflow/runtime@1.29.2"
      - "@voiceflow/sdk-runtime@1.43.1"
      - "@voiceflow/sdk-runtime@1.43.2"
      - "@voiceflow/secrets-provider@1.9.2"
      - "@voiceflow/secrets-provider@1.9.3"
      - "@voiceflow/semantic-release-config@1.4.1"
      - "@voiceflow/semantic-release-config@1.4.2"
      - "@voiceflow/serverless-plugin-typescript@2.1.7"
      - "@voiceflow/serverless-plugin-typescript@2.1.8"
      - "@voiceflow/slate-serializer@1.7.3"
      - "@voiceflow/slate-serializer@1.7.4"
      - "@voiceflow/stitches-react@2.3.2"
      - "@voiceflow/stitches-react@2.3.3"
      - "@voiceflow/storybook-config@1.2.2"
      - "@voiceflow/storybook-config@1.2.3"
      - "@voiceflow/stylelint-config@1.1.1"
      - "@voiceflow/stylelint-config@1.1.2"
      - "@voiceflow/test-common@2.1.1"
      - "@voiceflow/test-common@2.1.2"
      - "@voiceflow/tsconfig-paths@1.1.4"
      - "@voiceflow/tsconfig-paths@1.1.5"
      - "@voiceflow/tsconfig@1.12.1"
      - "@voiceflow/tsconfig@1.12.2"
      - "@voiceflow/utils-designer@1.74.19"
      - "@voiceflow/utils-designer@1.74.20"
      - "@voiceflow/verror@1.1.4"
      - "@voiceflow/verror@1.1.5"
      - "@voiceflow/vite-config@2.6.2"
      - "@voiceflow/vite-config@2.6.3"
      - "@voiceflow/vitest-config@1.10.2"
      - "@voiceflow/vitest-config@1.10.3"
      - "@voiceflow/voice-types@2.10.58"
      - "@voiceflow/voice-types@2.10.59"
      - "@voiceflow/voiceflow-types@3.32.45"
      - "@voiceflow/voiceflow-types@3.32.46"
      - "@voiceflow/widget@1.7.18"
      - "@voiceflow/widget@1.7.19"
      - "@vucod/email@0.0.3"
      - "@zapier/ai-actions-react@0.1.12"
      - "@zapier/ai-actions-react@0.1.13"
      - "@zapier/ai-actions-react@0.1.14"
      - "@zapier/ai-actions@0.1.18"
      - "@zapier/ai-actions@0.1.19"
      - "@zapier/ai-actions@0.1.20"
      - "@zapier/babel-preset-zapier@6.4.1"
      - "@zapier/babel-preset-zapier@6.4.2"
      - "@zapier/babel-preset-zapier@6.4.3"
      - "@zapier/browserslist-config-zapier@1.0.3"
      - "@zapier/browserslist-config-zapier@1.0.4"
      - "@zapier/browserslist-config-zapier@1.0.5"
      - "@zapier/eslint-plugin-zapier@11.0.3"
      - "@zapier/eslint-plugin-zapier@11.0.4"
      - "@zapier/eslint-plugin-zapier@11.0.5"
      - "@zapier/mcp-integration@3.0.1"
      - "@zapier/mcp-integration@3.0.2"
      - "@zapier/mcp-integration@3.0.3"
      - "@zapier/secret-scrubber@1.1.3"
      - "@zapier/secret-scrubber@1.1.4"
      - "@zapier/secret-scrubber@1.1.5"
      - "@zapier/spectral-api-ruleset@1.9.1"
      - "@zapier/spectral-api-ruleset@1.9.2"
      - "@zapier/spectral-api-ruleset@1.9.3"
      - "@zapier/stubtree@0.1.2"
      - "@zapier/stubtree@0.1.3"
      - "@zapier/stubtree@0.1.4"
      - "@zapier/zapier-sdk@0.15.5"
      - "@zapier/zapier-sdk@0.15.6"
      - "@zapier/zapier-sdk@0.15.7"
      - ai-crowl-shield@1.0.7
      - arc-cli-fc@1.0.1
      - asciitranslator@1.0.3
      - asyncapi-preview@1.0.1
      - asyncapi-preview@1.0.2
      - atrix-mongoose@1.0.1
      - atrix@1.0.1
      - automation_model@1.0.491
      - avvvatars-vue@1.1.2
      - axios-builder@1.2.1
      - axios-cancelable@1.0.1
      - axios-cancelable@1.0.2
      - axios-timed@1.0.1
      - axios-timed@1.0.2
      - babel-preset-kinvey-flex-service@0.1.1
      - barebones-css@1.1.3
      - barebones-css@1.1.4
      - benmostyn-frame-print@1.0.1
      - bestgpiocontroller@1.0.10
      - better-auth-nuxt@0.0.10
      - better-queue-nedb@0.1.5
      - bidirectional-adapter@1.2.2
      - bidirectional-adapter@1.2.3
      - bidirectional-adapter@1.2.4
      - bidirectional-adapter@1.2.5
      - blinqio-executions-cli@1.0.41
      - blob-to-base64@1.0.3
      - bool-expressions@0.1.2
      - buffered-interpolation-babylon6@0.2.8
      - bun-plugin-httpfile@0.1.1
      - bytecode-checker-cli@1.0.10
      - bytecode-checker-cli@1.0.11
      - bytecode-checker-cli@1.0.8
      - bytecode-checker-cli@1.0.9
      - bytes-to-x@1.0.1
      - calc-loan-interest@1.0.4
      - capacitor-plugin-apptrackingios@0.0.21
      - capacitor-plugin-purchase@0.1.1
      - capacitor-plugin-scgssigninwithgoogle@0.0.5
      - capacitor-purchase-history@0.0.10
      - capacitor-voice-recorder-wav@6.0.3
      - cbre-flow-common@1.3.1
      - cbre-flow-common@1.3.2
      - ceviz@0.0.5
      - chrome-extension-downloads@0.0.3
      - chrome-extension-downloads@0.0.4
      - claude-token-updater@1.0.3
      - coinmarketcap-api@3.1.2
      - coinmarketcap-api@3.1.3
      - colors-regex@2.0.1
      - command-irail@0.5.4
      - compare-obj@1.1.1
      - compare-obj@1.1.2
      - composite-reducer@1.0.2
      - composite-reducer@1.0.3
      - composite-reducer@1.0.4
      - composite-reducer@1.0.5
      - count-it-down@1.0.1
      - count-it-down@1.0.2
      - cpu-instructions@0.0.14
      - create-director-app@0.1.1
      - create-glee-app@0.2.2
      - create-glee-app@0.2.3
      - create-hardhat3-app@1.1.1
      - create-hardhat3-app@1.1.2
      - create-hardhat3-app@1.1.3
      - create-hardhat3-app@1.1.4
      - create-kinvey-flex-service@0.2.1
      - create-mcp-use-app@0.5.3
      - create-mcp-use-app@0.5.4
      - create-silgi@0.3.1
      - crypto-addr-codec@0.1.9
      - css-dedoupe@0.1.2
      - csv-tool-cli@1.2.1
      - dashboard-empty-state@1.0.3
      - designstudiouiux@1.0.1
      - devstart-cli@1.0.6
      - dialogflow-es@1.1.1
      - dialogflow-es@1.1.2
      - dialogflow-es@1.1.3
      - dialogflow-es@1.1.4
      - discord-bot-server@0.1.2
      - docusaurus-plugin-vanilla-extract@1.0.3
      - dont-go@1.1.2
      - dotnet-template@0.0.3
      - dotnet-template@0.0.4
      - drop-events-on-property-plugin@0.0.2
      - easypanel-sdk@0.3.2
      - electron-volt@0.0.2
      - email-deliverability-tester@1.1.1
      - enforce-branch-name@1.1.3
      - esbuild-plugin-brotli@0.2.1
      - esbuild-plugin-eta@0.1.1
      - esbuild-plugin-httpfile@0.4.1
      - eslint-config-kinvey-flex-service@0.1.1
      - eslint-config-nitpicky@4.0.1
      - eslint-config-trigo@22.0.2
      - eslint-config-zeallat-base@1.0.4
      - ethereum-ens@0.8.1
      - evm-checkcode-cli@1.0.12
      - evm-checkcode-cli@1.0.13
      - evm-checkcode-cli@1.0.14
      - evm-checkcode-cli@1.0.15
      - exact-ticker@0.3.5
      - expo-audio-session@0.2.1
      - expo-router-on-rails@0.0.4
      - express-starter-template@1.0.10
      - expressos@1.1.3
      - fat-fingered@1.0.1
      - fat-fingered@1.0.2
      - feature-flip@1.0.1
      - feature-flip@1.0.2
      - firestore-search-engine@1.2.3
      - fittxt@1.0.2
      - fittxt@1.0.3
      - flapstacks@1.0.1
      - flapstacks@1.0.2
      - flatten-unflatten@1.0.1
      - flatten-unflatten@1.0.2
      - formik-error-focus@2.0.1
      - formik-store@1.0.1
      - frontity-starter-theme@1.0.1
      - fuzzy-finder@1.0.5
      - fuzzy-finder@1.0.6
      - gate-evm-check-code2@2.0.3
      - gate-evm-check-code2@2.0.4
      - gate-evm-check-code2@2.0.5
      - gate-evm-check-code2@2.0.6
      - gate-evm-tools-test@1.0.5
      - gate-evm-tools-test@1.0.6
      - gate-evm-tools-test@1.0.7
      - gate-evm-tools-test@1.0.8
      - gatsby-plugin-antd@2.2.1
      - gatsby-plugin-cname@1.0.1
      - gatsby-plugin-cname@1.0.2
      - generator-meteor-stock@0.1.6
      - generator-ng-itobuz@0.0.15
      - get-them-args@1.3.3
      - github-action-for-generator@2.1.27
      - github-action-for-generator@2.1.28
      - gitsafe@1.0.5
      - go-template@0.1.8
      - go-template@0.1.9
      - gulp-inject-envs@1.2.1
      - gulp-inject-envs@1.2.2
      - haufe-axera-api-client@0.0.1
      - haufe-axera-api-client@0.0.2
      - hope-mapboxdraw@0.1.1
      - hopedraw@1.0.3
      - hover-design-prototype@0.0.5
      - httpness@1.0.2
      - httpness@1.0.3
      - hyper-fullfacing@1.0.3
      - hyperterm-hipster@1.0.7
      - ids-css@1.5.1
      - ids-enterprise-mcp-server@0.0.2
      - ids-enterprise-ng@20.1.6
      - ids-enterprise-typings@20.1.6
      - image-to-uri@1.0.1
      - image-to-uri@1.0.2
      - insomnia-plugin-random-pick@1.0.4
      - invo@0.2.2
      - iron-shield-miniapp@0.0.2
      - ito-button@8.0.3
      - itobuz-angular-auth@8.0.11
      - itobuz-angular-button@8.0.11
      - itobuz-angular@0.0.1
      - jacob-zuma@1.0.1
      - jacob-zuma@1.0.2
      - jaetut-varit-test@1.0.2
      - jan-browser@0.13.1
      - jquery-bindings@1.1.2
      - jquery-bindings@1.1.3
      - jsonsurge@1.0.7
      - just-toasty@1.7.1
      - kill-port@2.0.2
      - kill-port@2.0.3
      - kinetix-default-token-list@1.0.5
      - kinvey-cli-wrapper@0.3.1
      - kinvey-flex-scripts@0.5.1
      - kns-error-code@1.0.8
      - korea-administrative-area-geo-json-util@1.0.7
      - kwami@1.5.10
      - kwami@1.5.9
      - lang-codes@1.0.1
      - lang-codes@1.0.2
      - license-o-matic@1.2.1
      - license-o-matic@1.2.2
      - lint-staged-imagemin@1.3.1
      - lint-staged-imagemin@1.3.2
      - lite-serper-mcp-server@0.2.2
      - lui-vue-test@0.70.9
      - luno-api@1.2.3
      - m25-transaction-utils@1.1.16
      - manual-billing-system-miniapp-api@1.3.1
      - mcp-use@1.4.2
      - mcp-use@1.4.3
      - medusa-plugin-announcement@0.0.3
      - medusa-plugin-logs@0.0.17
      - medusa-plugin-momo@0.0.68
      - medusa-plugin-product-reviews-kvy@0.0.4
      - medusa-plugin-zalopay@0.0.40
      - mod10-check-digit@1.0.1
      - mon-package-react-typescript@1.0.1
      - my-saeed-lib@0.1.1
      - n8n-nodes-tmdb@0.5.1
      - n8n-nodes-vercel-ai-sdk@0.1.7
      - n8n-nodes-viral-app@0.2.5
      - nanoreset@7.0.1
      - nanoreset@7.0.2
      - next-circular-dependency@1.0.2
      - next-circular-dependency@1.0.3
      - next-simple-google-analytics@1.1.1
      - next-simple-google-analytics@1.1.2
      - next-styled-nprogress@1.0.4
      - next-styled-nprogress@1.0.5
      - ngx-useful-swiper-prosenjit@9.0.2
      - ngx-wooapi@12.0.1
      - nitro-graphql@1.5.12
      - nitro-kutu@0.1.1
      - nitrodeploy@1.0.8
      - nitroping@0.1.1
      - normal-store@1.3.1
      - normal-store@1.3.2
      - normal-store@1.3.3
      - normal-store@1.3.4
      - nuxt-keycloak@0.2.2
      - obj-to-css@1.0.2
      - obj-to-css@1.0.3
      - okta-react-router-6@5.0.1
      - open2internet@0.1.1
      - orbit-boxicons@2.1.3
      - orbit-nebula-draw-tools@1.0.10
      - orbit-nebula-editor@1.0.2
      - orbit-soap@0.43.13
      - orchestrix@12.1.2
      - package-tester@1.0.1
      - parcel-plugin-asset-copier@1.1.2
      - parcel-plugin-asset-copier@1.1.3
      - pdf-annotation@0.0.2
      - pergel@0.13.2
      - pergeltest@0.0.25
      - piclite@1.0.1
      - pico-uid@1.0.3
      - pico-uid@1.0.4
      - pkg-readme@1.1.1
      - poper-react-sdk@0.1.2
      - posthog-docusaurus@2.0.6
      - posthog-js@1.297.3
      - posthog-node@4.18.1
      - posthog-node@5.11.3
      - posthog-node@5.13.3
      - posthog-plugin-hello-world@1.0.1
      - posthog-react-native-session-replay@1.2.2
      - posthog-react-native@4.11.1
      - posthog-react-native@4.12.5
      - prime-one-table@0.0.19
      - prompt-eng-server@1.0.18
      - prompt-eng@1.0.50
      - puny-req@1.0.3
      - quickswap-ads-list@1.0.33
      - quickswap-default-staking-list-address@1.0.55
      - quickswap-default-staking-list@1.0.11
      - quickswap-default-token-list@1.5.16
      - quickswap-router-sdk@1.0.1
      - quickswap-sdk@3.0.44
      - quickswap-smart-order-router@1.0.1
      - quickswap-token-lists@1.0.3
      - quickswap-v2-sdk@2.0.1
      - ra-auth-firebase@1.0.3
      - ra-data-firebase@1.0.7
      - ra-data-firebase@1.0.8
      - react-component-taggers@0.1.9
      - react-data-to-export@1.0.1
      - react-element-prompt-inspector@0.1.18
      - react-favic@1.0.2
      - react-hook-form-persist@3.0.1
      - react-hook-form-persist@3.0.2
      - react-jam-icons@1.0.1
      - react-jam-icons@1.0.2
      - react-keycloak-context@1.0.8
      - react-keycloak-context@1.0.9
      - react-library-setup@0.0.6
      - react-linear-loader@1.0.2
      - react-micromodal.js@1.0.1
      - react-micromodal.js@1.0.2
      - react-native-datepicker-modal@1.3.1
      - react-native-datepicker-modal@1.3.2
      - react-native-email@2.1.1
      - react-native-email@2.1.2
      - react-native-fetch@2.0.1
      - react-native-fetch@2.0.2
      - react-native-get-pixel-dimensions@1.0.1
      - react-native-get-pixel-dimensions@1.0.2
      - react-native-google-maps-directions@2.1.2
      - react-native-jam-icons@1.0.1
      - react-native-jam-icons@1.0.2
      - react-native-log-level@1.2.1
      - react-native-log-level@1.2.2
      - react-native-modest-checkbox@3.3.1
      - react-native-modest-storage@2.1.1
      - react-native-phone-call@1.2.1
      - react-native-phone-call@1.2.2
      - react-native-retriable-fetch@2.0.1
      - react-native-retriable-fetch@2.0.2
      - react-native-use-modal@1.0.3
      - react-native-view-finder@1.2.1
      - react-native-view-finder@1.2.2
      - react-native-websocket@1.0.3
      - react-native-websocket@1.0.4
      - react-native-worklet-functions@3.3.3
      - react-packery-component@1.0.3
      - react-qr-image@1.1.1
      - react-scrambled-text@1.0.4
      - rediff-viewer@0.0.7
      - rediff@1.0.5
      - redux-forge@2.5.3
      - redux-router-kit@1.2.2
      - redux-router-kit@1.2.3
      - redux-router-kit@1.2.4
      - revenuecat@1.0.1
      - rollup-plugin-httpfile@0.2.1
      - sa-company-registration-number-regex@1.0.1
      - sa-company-registration-number-regex@1.0.2
      - sa-id-gen@1.0.4
      - sa-id-gen@1.0.5
      - samesame@1.0.3
      - scgs-capacitor-subscribe@1.0.11
      - scgsffcreator@1.0.5
      - schob@1.0.3
      - selenium-session-client@1.0.4
      - selenium-session@1.0.5
      - set-nested-prop@2.0.1
      - set-nested-prop@2.0.2
      - shelf-jwt-sessions@0.1.2
      - shell-exec@1.1.3
      - shell-exec@1.1.4
      - shinhan-limit-scrap@1.0.3
      - silgi@0.43.30
      - simplejsonform@1.0.1
      - skills-use@0.1.1
      - skills-use@0.1.2
      - solomon-api-stories@1.0.2
      - solomon-v3-stories@1.15.6
      - solomon-v3-ui-wrapper@1.6.1
      - soneium-acs@1.0.1
      - sort-by-distance@2.0.1
      - south-african-id-info@1.0.2
      - stat-fns@1.0.1
      - stoor@2.3.2
      - sufetch@0.4.1
      - super-commit@1.0.1
      - svelte-autocomplete-select@1.1.1
      - svelte-toasty@1.1.2
      - svelte-toasty@1.1.3
      - tanstack-shadcn-table@1.1.5
      - tavily-module@1.0.1
      - tcsp-draw-test@1.0.5
      - tcsp-test-vd@2.4.4
      - tcsp@2.0.2
      - template-lib@1.1.3
      - template-lib@1.1.4
      - template-micro-service@1.0.2
      - template-micro-service@1.0.3
      - tenacious-fetch@2.3.2
      - tenacious-fetch@2.3.3
      - test-foundry-app@1.0.1
      - test-foundry-app@1.0.2
      - test-foundry-app@1.0.3
      - test-foundry-app@1.0.4
      - test-hardhat-app@1.0.1
      - test-hardhat-app@1.0.2
      - test-hardhat-app@1.0.3
      - test-hardhat-app@1.0.4
      - test23112222-api@1.0.1
      - tiaan@1.0.2
      - tiptap-shadcn-vue@0.2.1
      - token.js-fork@0.7.32
      - toonfetch@0.3.2
      - trigo-react-app@4.1.2
      - ts-relay-cursor-paging@2.1.1
      - typeface-antonio-complete@1.0.5
      - typefence@1.2.2
      - typefence@1.2.3
      - typeorm-orbit@0.2.27
      - unadapter@0.1.3
      - undefsafe-typed@1.0.3
      - undefsafe-typed@1.0.4
      - unemail@0.3.1
      - uniswap-router-sdk@1.6.2
      - uniswap-smart-order-router@3.16.26
      - uniswap-test-sdk-core@4.0.8
      - unsearch@0.0.3
      - uplandui@0.5.4
      - upload-to-play-store@1.0.1
      - upload-to-play-store@1.0.2
      - url-encode-decode@1.0.1
      - url-encode-decode@1.0.2
      - use-unsaved-changes@1.0.9
      - v-plausible@1.2.1
      - valid-south-african-id@1.0.3
      - valuedex-sdk@3.0.5
      - vf-oss-template@1.0.1
      - vf-oss-template@1.0.2
      - vf-oss-template@1.0.3
      - vf-oss-template@1.0.4
      - victoria-wallet-constants@0.1.1
      - victoria-wallet-constants@0.1.2
      - victoria-wallet-core@0.1.1
      - victoria-wallet-core@0.1.2
      - victoria-wallet-type@0.1.1
      - victoria-wallet-type@0.1.2
      - victoria-wallet-utils@0.1.1
      - victoria-wallet-utils@0.1.2
      - victoria-wallet-validator@0.1.1
      - victoria-wallet-validator@0.1.2
      - victoriaxoaquyet-wallet-core@0.2.1
      - victoriaxoaquyet-wallet-core@0.2.2
      - vite-plugin-httpfile@0.2.1
      - vue-browserupdate-nuxt@1.0.5
      - wallet-evm@0.3.1
      - wallet-evm@0.3.2
      - wallet-type@0.1.1
      - wallet-type@0.1.2
      - web-scraper-mcp@1.1.4
      - web-types-htmx@0.1.1
      - web-types-lit@0.1.1
      - webpack-loader-httpfile@0.2.1
      - wellness-expert-ng-gallery@5.1.1
      - wenk@1.0.10
      - wenk@1.0.9
      - zapier-async-storage@1.0.1
      - zapier-async-storage@1.0.2
      - zapier-async-storage@1.0.3
      - zapier-platform-cli@18.0.2
      - zapier-platform-cli@18.0.3
      - zapier-platform-cli@18.0.4
      - zapier-platform-core@18.0.2
      - zapier-platform-core@18.0.3
      - zapier-platform-core@18.0.4
      - zapier-platform-legacy-scripting-runner@4.0.2
      - zapier-platform-legacy-scripting-runner@4.0.3
      - zapier-platform-legacy-scripting-runner@4.0.4
      - zapier-platform-schema@18.0.2
      - zapier-platform-schema@18.0.3
      - zapier-platform-schema@18.0.4
      - zapier-scripts@7.8.3
      - zapier-scripts@7.8.4
      - zuper-cli@1.0.1
      - zuper-sdk@1.0.57
      - zuper-stream@2.0.9
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Linux process executions where npm is used to install a specific list of package names and exact versions tied to the Shai-Hulud 2.0 supply chain campaign. The behavior matters because installing attacker-controlled npm packages enables malicious code to enter the build environment and downstream software. Detection relies on process creation telemetry, matching the command line for both the installer intent and the presence of known malicious package@version strings in the npm command.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.