Mini Shai-Hulud payload hashes (3FWCvzduYZg.js, binding.gyp)

F S@Fsdr

•updated Sep 3, 2026•1•0•3

Detects the presence of known malicious file hashes associated with the Mini Shai-Hulud supply chain compromise (e.g., malicious npm package artifacts). The rule monitors device file, process, and image load events for SHA256 matches.