GCVE-VVD-OSM-2026-836

This package is part of the Shai-Hulud Second Coming supply chain worm This was the only Maven/Java package affected by the Sha1-hulud Second Coming attack. The latest malicious campaign referred to as Shai-Hulud 2.0 is an ongoing npm software supply chain attack where threat actors compromised maintainer accounts to publish trojanized versions of legitimate npm packages. The attack's core mechanism involves a malicious script executing during the package's preinstall phase which is designed to achieve persistence by registering the infected machine as a self-hosted GitHub runner. The malware then steals and exfiltrates sensitive data primarily focusing on developer and CI/CD secrets from the infected environments including GitHub secrets and cloud credentials for platforms like AWS Azure and GCP. High-profile targets affected by the compromise of their internal packages include organizations such as Zapier and ENS Domains.