below[.]nameDomain

Reported by 1 independent source · first reported 3 Dec 2025 by Zscaler ThreatLabz · last reported 3 Dec 2025

Last reported 10 months ago

What the reports say

1 report, newest first · the exact sentence from each

“…alware downloads the artifacts.Deletes the workflow and branch to hide evidence of the malware’s presence.The actual workflow is shown below[.]name: Code Formatter”

Zscaler ThreatLabzVendor3 Dec 2025
Shai-Hulud V2 Poses Risk To NPM Supply Chain

Indicators reported together

named in the same reports

detected[.]inin 1 report
environment[.]ciin 1 report
history[.]cloudin 1 report
executions[.]datain 1 report
hxxps://raw.githubusercontent[.]com/$in 1 report
repo[.]namein 1 report
hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gzin 1 report
hxxps://github[.]com/$in 1 report
data[.]azurein 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

detected[.]in
environment[.]ci
history[.]cloud
executions[.]data
hxxps://raw.githubusercontent[.]com/$
repo[.]name
hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gz
hxxps://github[.]com/$
data[.]azure

Thanks — we review every report.

Report a wrong value