hxxp://169[.]254[.]169[.]254

Posts referencing this indicator

• Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack

  AWS IMDS endpoint targeted by the malware to harvest cloud credentials

  2026-05-13
• lightning PyPI Package Compromised in Supply Chain Attack

  AWS IMDS endpoint targeted by the malware for credential theft

  2026-05-13