SlowMist Warns of Return of Shai-Hulud 3.0 Supply Chain Attack

By: crypto insight|2025/12/29 14:30:19

Key Takeaways

SlowMist’s Chief Information Security Officer alerted the community about the resurgence of Shai-Hulud 3.0, an advanced supply chain attack targeting the NPM ecosystem.
Shai-Hulud 3.0 focuses on stealing cloud credentials and has evolved from previous versions with increased destructive capabilities.
Previous incidents involved a Trust Wallet API key leak, likely resulting from earlier Shai-Hulud attacks.
The attack exemplifies how sophisticated malware has become, utilizing automation to expand its reach rapidly.

WEEX Crypto News, 29 December 2025

Shai-Hulud 3.0 Supply Chain Attack: A Foreboding Return

In a fresh wave of cybersecurity threats, SlowMist has issued a warning regarding the latest iteration of the Shai-Hulud 3.0 supply chain attack, marking its disturbing re-emergence in the tech industry. This attack specifically targets the NPM ecosystem, a fundamental part of the JavaScript development community, to exfiltrate sensitive cloud keys and credentials. As the year draws to a close, this alert serves as a stark reminder of the need for robust cybersecurity practices.

The Evolution of a Cyber Threat

Shai-Hulud 3.0 is not the beginning of its story but rather a continuation of a series of supply chain attacks that have terrorized the tech landscape. It began with version 1.0, which quietly stole credentials, evolving through to version 2.0, which introduced self-healing capabilities alongside a destructive mode that allowed it to wipe entire directories if necessary. Now, with version 3.0, the capabilities appear yet more sophisticated, emphasizing the necessity for heightened vigilance.

The strategy transmitted by Shai-Hulud 3.0 involves leveraging compromised packages to embed malicious code within widely used JavaScript libraries. By exploiting developer trust environments such as NPM, the attack propagates quickly, inserting malicious workflows into GitHub repositories to achieve automated proliferation and exfiltration of sensitive data.

NPM Ecosystem: A Chief Target

The Shai-Hulud attack chain is indicative of a broader trend of supply chain attacks within the NPM ecosystem. Both maintainers and developers are at direct risk, given this worm’s capacity to automize its spread across repositories and exploit harvested credentials for further malware penetration. It highlights vulnerabilities within our software supply chains, underscoring how attackers innovate by turning our very development tools into vectors of attack.

Trust Wallet: A Victim of Supply Chain Vulnerability

One significant incident believed to result from an earlier Shai-Hulud attack was the Trust Wallet API key leak. This compromise demonstrates how previous iterations of Shai-Hulud managed to breach security defenses, leading to widespread consequences. The leak allowed attackers to deploy malicious code, suggesting that the worm’s capacity for disruption can span across various ecosystems, affecting major players in the cryptocurrency and tech sectors alike.

Defensive Strategies: Strengthening Cybersecurity Posture

In the face of such threats, SlowMist’s warning acts as a call to arms for developers and organizations to bolster their defenses. Protection against such attacks is not merely about reactive security but also about proactive measures including regular security audits, dependency hygiene, and investment in robust software composition analysis tools.

Organizations are urged to adopt comprehensive supply chain security measures, identify compromised packages early, and deploy strategies to contain and remediate attacks. Utilizing modern tools that integrate with existing CI/CD pipelines can provide the readiness required to face these evolving threats head-on.

Looking Forward: Building a Secure Future

As cyber threats grow in sophistication, the tech industry must remain ever-vigilant and adaptive. The threat posed by Shai-Hulud 3.0 exemplifies the challenges of maintaining a secure development environment in a continuously changing landscape. To adequately protect against these attacks, the industry must prioritize security as an integral part of the development process, ensuring that all stakeholders from developers to security teams are prepared to defend against these complex threats. Platforms like WEEX offer comprehensive solutions for a safe and reliable trading environment; explore their offerings [here](https://www.weex.com/register?vipCode=vrmi).

FAQs

What is Shai-Hulud 3.0?

Shai-Hulud 3.0 is an advanced malware attack that targets the NPM ecosystem to steal cloud keys and credentials. It is a sophisticated supply chain attack designed to automate the spread and infiltration of systems using malicious NPM packages.

How does Shai-Hulud 3.0 affect developers?

This attack compromises developer environments by targeting NPM package maintainers and developers. By embedding malicious code into popular libraries, it exploits trust networks to expand its reach and compromise additional accounts.

What steps can developers take to protect against Shai-Hulud 3.0?

Developers should engage in regular security audits, maintain strict dependency hygiene, and implement robust software composition analysis tools. It’s essential to verify package authenticity and regularly update security practices.

Was Trust Wallet affected by Shai-Hulud 3.0?

While it’s not stated if the recent version directly affected Trust Wallet, a prior API key leak linked to an earlier version of Shai-Hulud suggests that this type of attack has impacted their platform, demonstrating the reach and potential dangers of such threats.

How can organizations improve security against supply chain attacks?

Organizations should deploy comprehensive security measures that include real-time monitoring, automated security checks, and regular vulnerability assessments. Educating teams on the latest threats and preventive strategies is crucial for maintaining a secure working environment.

-- Price

On March 16, 2026, in Dallas, Texas, USA, CanGu Company (New York Stock Exchange code: CANG, hereinafter referred to as "CanGu" or the "Company") today announced its unaudited financial performance for the fourth quarter and full year ended December 31, 2025. As a btc-42">bitcoin mining enterprise relying on a globally operated layout and dedicated to building an integrated energy and AI computing power platform, CanGu is actively advancing its business transformation and infrastructure development.

2025 Full Year and Fourth Quarter Financial and Operational Highlights

• Financial Performance:

Total revenue for the full year 2025 was $688.1 million, with $179.5 million in the fourth quarter.

Bitcoin mining business revenue for the full year was $675.5 million, with $172.4 million in the fourth quarter.

Full-year adjusted EBITDA was $24.5 million, while the fourth quarter was -$156.3 million.

• Mining Operations and Costs:

A total of 6,594.6 bitcoins were mined throughout the year, averaging 18.07 bitcoins per day; of which 1,718.3 bitcoins were mined in the fourth quarter, averaging 18.68 bitcoins per day.

The average mining cost for the full year (excluding miner depreciation) was $79,707 per bitcoin, and for the fourth quarter, it was $84,552;

The all-in sustaining costs were $97,272 and $106,251 per bitcoin, respectively.

As of the end of December 2025, the company has cumulatively produced 7,528.4 bitcoins since entering the bitcoin mining business.

• Strategic Progress:

The company has completed the termination of the American Depositary Receipt (ADR) program and transitioned to a direct listing on the NYSE to enhance information transparency and align with its strategic direction, with a long-term goal of expanding its investor base.

CEO Paul Yu stated: "2025 marked the company's first full year as a bitcoin mining enterprise, characterized by rapid execution and structural reshaping. We completed a comprehensive adjustment of our asset system and established a globally distributed mining network. Additionally, the company introduced a new management team, further strengthening our capabilities and competitive advantage in the digital asset and energy infrastructure space. The completion of the NYSE direct listing and USD pricing also signifies our transformation into a global AI infrastructure company."

"As we enter 2026, the company will continue to optimize its balance sheet structure and enhance operational efficiency and cost resilience through adjustments to the miner portfolio. At the same time, we are advancing our strategic transformation into an AI infrastructure provider. Leveraging EcoHash, we will utilize our capabilities in scalable computing power and energy networks to provide cost-effective AI inference solutions. The relevant site transformations and product development are progressing simultaneously, and the company is well-positioned to sustain its execution in the new phase."

The company's Chief Financial Officer, Michael Zhang, stated: "By 2025, the company is expected to achieve significant revenue growth through its scaled mining operations. Despite recording a net loss of $452.8 million from ongoing operations, mainly due to one-time transformation costs and market-driven fair value adjustments, the company, from a financial perspective, will reduce its leverage, optimize its Bitcoin reserve strategy and liquidity management, introduce new capital to strengthen its financial position, and seize investment opportunities in high-potential areas such as AI infrastructure while navigating market volatility."

Fourth Quarter 2025 Ongoing Operations Financial Performance

Revenue

The total revenue for the fourth quarter was $1.795 billion. Of this, the Bitcoin mining business contributed $1.724 billion in revenue, generating 1,718.3 Bitcoins during the quarter. Revenue from the international automobile trading business was $4.8 million.

Operating Costs and Expenses

The total operating costs and expenses for the fourth quarter amounted to $4.56 billion, primarily attributed to expenses related to the Bitcoin mining business, as well as impairment of mining machines and fair value losses on Bitcoin collateral receivables.

This includes:

· Cost of Revenue (excluding depreciation): $1.553 billion

· Cost of Revenue (depreciation): $38.1 million

· Operating Expenses: $9.9 million (including related-party expenses of $1.1 million)

· Mining Machine Impairment Loss: $81.4 million

· Fair Value Loss on Bitcoin Collateral Receivables: $171.4 million

Profit Situation

The operating loss for the fourth quarter was $276.6 million, a significant increase from a loss of $0.7 million in the same period of 2024, primarily due to the downward trend in Bitcoin prices.

The net loss from ongoing operations was $285 million, compared to a net profit of $2.4 million in the same period last year.

The adjusted EBITDA was -$156.3 million, compared to $2.4 million in the same period last year.

Full Year 2025 Ongoing Operations Financial Performance

Revenue

The total revenue for the full year was $6.881 billion. Of this, the revenue from the Bitcoin mining business was $6.755 billion, with a total output of 6,594.6 Bitcoins for the year. Revenue from the international automobile trading business was $9.8 million.

Operating Costs and Expenses

The total annual operating costs and expenses amount to $1.1 billion.

Specifically, they include:

· Revenue Cost (excluding depreciation): $543.3 million

· Revenue Cost (depreciation): $116.6 million

· Operating Expenses: $28.9 million (including related-party expenses of $1.1 million)

· Miner Impairment Loss: $338.3 million

· Bitcoin Collateral Receivable Fair Value Change Loss: $96.5 million

Profitability

The full-year operating loss is $437.1 million. The continuing operations net loss is $452.8 million, while in 2024, there was a net profit of $4.8 million.

The 2025 non-GAAP adjusted net profit is $24.5 million (compared to $5.7 million in 2024). This measure does not include share-based compensation expenses; refer to "Use of Non-GAAP Financial Measures" for details.

Financial Position

As of December 31, 2025, the company's key assets and liabilities are as follows:

· Cash and Cash Equivalents: $41.2 million

· Bitcoin Collateral Receivable (Non-current, related party): $663.0 million

· Miner Net Value: $248.7 million

· Long-Term Debt (related party): $557.6 million

In February 2026, the company sold 4,451 bitcoins and repaid a portion of related-party long-term debt to reduce financial leverage and optimize the asset-liability structure.

Stock Repurchase

As per the stock repurchase plan disclosed on March 13, 2025, as of December 31, 2025, the company had repurchased a total of 890,155 shares of Class A common stock for approximately $1.2 million.

The US AI Startup Is Loving China's Open Source Model

80% of US AI Startups Are Using Chinese Open Source Models

Three Weeks of the US-Iran War: Who's Making Money, Who's Paying the Bill?

Global Losing 10 Million Barrels of Oil Each Day, Russia Earns Over $800 Million in Just Over Two Weeks

Interpreting Polymarket's Major Update Last Night: Fee Expansion, Self-Regulation, and New Incentives

Although there is no information about a token airdrop, the overall community sentiment is optimistic. The real good news is to rhythmically control the positive promotion.

From Human Application to Intelligent Collaboration: How GOAT Network Builds the Next Generation Digital Economy

Embracing the Era of Super Individuals: GOAT Network launches Bitcoin-secured Layer 2 exclusive infrastructure, fully empowering AI entities to usher in a new era of fully automated digital economy.

CZ Washington Dialogue: Crypto Entrepreneurs are Accelerating Their Return to the United States

CZ connects with the DC Blockchain Summit: The prison memoir is about to be published, harshly criticizing the inaccuracies of traditional media reports, and pointing out that if the U.S. wants to become the "global crypto capital," it urgently needs to introduce more sufficient market competition t...