On August 4, the largest Shai-Hulud wave to date compromised the widely used keyv ecosystem and spread to more than 400 npm packages within hours. The attack marked an important evolution: software build pipelines and the trust mechanisms designed to secure them have become the attack surface.

Lahav Meir and Matan Naftali, Senior Enterprise Security Experts at Sygnia, offer an inside look at the latest Shai-Hulud activity, translating insights from Sygnia’s recently published advisory, Shai-Hulud Returns: When Software Trust Becomes the Attack Surface, into practical actions security teams can take now.

Drawing on Sygnia’s first-hand experience responding to Shai-Hulud incidents, Lahav and Matan share real-world examples from actual investigations and show how these attacks were tackled in practice.

Learn how to:

• Detect: Identify signals of compromise across developer endpoints, npm activity, CI/CD pipelines, publishing workflows, and cloud environments.
• Mitigate: Reduce exposure through stronger dependency controls, safer build environments, egress controls, and credential hygiene.
• Respond: Determine whether you are only a victim or also a distribution point, then contain affected environments, remove persistence, rotate credentials, and rebuild from trusted sources.
• Prepare: Strengthen your software supply-chain incident-response playbook so teams can act quickly and in coordination.

If Shai-Hulud reaches your environment, the critical questions are no longer just “Are we affected?” but “Where did it execute, what did it expose, did it propagate, and what do we do next?” This session gives you a practical framework for answering all four.