Buy Crypto
Pay with
USD
USD
Buy & Sell
Hot
Supports Visa, Mastercard, SEPA & more
P2P
0 Fees
Flexible trading, zero fees
Gate Card
Use your crypto for payments worldwide
Markets
Trade
Basic
Advanced
Futures
Futures
Access hundreds of perpetual contracts
CFD
Gold
One platform for global traditional assets
Options
Hot
Trade European-style vanilla options
Unified Account
Maximize your capital efficiency
Demo Trading
Introduction to Futures Trading
Learn the basics of futures trading
Futures Events
Join events to earn rewards
Demo Trading
Use virtual funds to practice risk-free trading
Stocks
CFD
U.S. stock CFD derivatives
US Stocks
Access real US stocks and ETFs
HK Stocks
Trade quality Hong Kong-listed stocks
Stock Futures
High leverage, 24/7 trading
Tokenized Stocks
Backed by real stock assets
IPO Access
Unlock full access to global stock IPOs
GUSD
Mint GUSD for Treasury RWA yields
Stocks Activities
Trade Popular Stocks and Unlock Generous Airdrops
Earn
Launch
CandyDrop
Collect candies to earn airdrops
Launchpool
Quick staking, earn potential new tokens
HODLer Airdrop
Hold GT and get massive airdrops for free
IPO Access
Unlock full access to global stock IPOs
Alpha Points
Trade on-chain assets and earn airdrops
Futures Points
Earn futures points and claim airdrop rewards
Investment
Square
Square
Post, share, and explore crypto trends
Live
moments live
Live crypto market analysis
Chat
Chat with crypto traders
News
What is happening in crypto
flower_head
More
Promotions
AI
Others
TradFi
2026 World Cup
Rewards

SlowMist Detects 'Mini Shai-Hulud' npm Worm Stealing CI/CD Keys and Crypto Wallet Data

GateNews
Security Incidents
According to blockchain security firm SlowMist, its threat monitoring system MistEye detected a sophisticated npm worm named 'Mini Shai-Hulud' spreading through developer projects including TanStack, UiPath, and DraftLab. The malware uses compromised GitHub credentials to publish packages disguised as legitimate updates, injecting a hidden script called router_init.js that runs silently in CI/CD environments like GitHub Actions. The worm targets CI/CD keys, cloud infrastructure credentials, and cryptocurrency wallet information, exfiltrating data via GitHub infrastructure. SlowMist advised affected projects to immediately scan CI/CD pipelines for router_init.js, rotate all exposed GitHub and cloud credentials, and monitor development environments for suspicious background activity.
View Source
Disclaimer: The information on this page may come from third-party sources and is for reference only. It does not represent the views or opinions of Gate and does not constitute any financial, investment, or legal advice. Virtual asset trading involves high risk. Please do not rely solely on the information on this page when making decisions. For details, see the Disclaimer.

Related News

05-12 07:26
Attackers Hijack TanStack, OpenSearch, Mistral Official Pipelines, Push 84 Malicious Versions on May 12
05-12 02:43
Two Private Key Leaks Expose $238K in 36 Hours, GoPlus Warns
05-11 19:42
India Issues Trust Wallet Drainer Advisory as New Scam Domain Hits BNB Users on May 3
05-11 08:54
SlowMist Discovers Malicious Chrome MV3 Extension Targeting TRON Wallet Users on May 11
05-11 00:07
Microsoft Discovers macOS Phishing Campaign Targeting Exodus, Ledger, and Trezor Wallets Since Late 2025
In-Depth Analysis

Google reveals the first AI-generated zero-day vulnerability: hackers aim to bypass 2FA for large-scale exploitation

ChainNewsAbmedia05-12 04:18

TanStack npm supply chain attacked by Mini Shai-Hulud, version 84 injected with credentials to steal code

Market Whisper05-12 01:39

SlowMist Warns of Fake TronLink Chrome Extension Phishing Attack

Crypto Frontier05-11 18:51
Comment
0/400
FenerliBabavip
· 05-12 07:48
2026 GOGOGO 👊
Reply0