erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: November 24, 2025

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Check exposure: Shai-Hulud 2.0 (Sha1-Hulud: The Second Coming). Teams whose lockfiles, CI logs or artifact caches show a flagged version installed in late November 2025, and anyone who finds a 'Sha1-Hulud' repo or SHA1HULUD runner under their GitHub account.
  • Go: 1 critical advisory (github.com/lf-edge/ekuiper/v2). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Supply-chain compromise

Shai-Hulud 2.0: npm Worm Hits PostHog, Zapier, Postman

The worm is long dead on npm, but any machine or CI runner that installed a trojanized version between Nov 21 and Nov 27, 2025 should be treated as having leaked every secret it could reach.

Must act: Teams whose lockfiles, CI logs or artifact caches show a flagged version installed in late November 2025, and anyone who finds a 'Sha1-Hulud' repo or SHA1HULUD runner under their GitHub account.

Can relax: Projects whose lockfiles were unchanged across Nov 21-27, 2025, or that installed only from builds or mirrors older than that window, were not exposed.

  1. Grep lockfiles and CI logs for flagged package versions and for setup_bun.js / bun_environment.js
  2. Search GitHub (user and org) for repos described 'Sha1-Hulud: The Second Coming' and for self-hosted runners named SHA1HULUD
  3. Delete .github/workflows/discussion.yaml and any unknown workflows or branches

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...