# Deepgram: Shai-Hulud 2.0 Supply Chain Incident – No Customer Impact

> Deepgram status incident “Shai-Hulud 2.0 Supply Chain Incident – No Customer Impact” on 2025-11-26: impact none (vendor’s label), 0 min, 1 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/deepgram/incidents/8xny9m4v24sr
Last updated: 2025-11-26T00:00:00Z

- Impact (vendor’s label): none
- Status: resolved
- Started: 2025-11-26 00:00 UTC · Resolved: 2025-11-26 00:00 UTC · Duration: 0 min
- Updates: 1
- [Vendor status page: https://status.deepgram.com/incidents/8xny9m4v24sr](https://status.deepgram.com/incidents/8xny9m4v24sr)
- [Company: Deepgram](https://rewindex.com/company/deepgram.md)

## Timeline of updates

- **resolved** 2025-11-26 00:00 UTC: Informational (No Customer Action Required) Deepgram identified that our internal development environment was affected as part of the industry-wide Shai-Hulud 2.0 NPM supply chain attack. The attack used compromised NPM packages to inject malicious CI/CD workflows and attempt to exfiltrate internal development credentials. Our investigation confirms: - No access to customer data or databases - No impact to production API infrastructure or service availability - No modification of published Deepgram SDKs or packages - No effect on customer authentication or API keys Timeline (UTC): - 00:41, Nov 26: Webhook alert on an internal GitHub repo; engineers link activity to Shai-Hulud 2.0, disable malicious workflows, and rotate exposed credentials. - 21:45, Nov 26: Additional commits via a compromised GitHub App publish some internal materials (no customer or production impact); the account is removed, GitHub Actions disabled, and the org moved into a locked-down state. We see no further signs of compromise and are gradually restoring normal operations while tightening SDLC and CI/CD controls. Customer action: None required. Questions: security@deepgram.com • support@deepgram.com This incident affected internal development infrastructure only; customer-facing APIs and services were not impacted.

_From the vendor’s published history: only the final update text is available for incidents before Rewindex began polling this page._

## Cite this

Status incident (vendor impact label: none) posted by Deepgram, started 2025-11-26 00:00 UTC, resolved after 0 min, 1 update(s).

- Canonical URL: https://rewindex.com/company/deepgram/incidents/8xny9m4v24sr
- Citation: Deepgram, “Shai-Hulud 2.0 Supply Chain Incident – No Customer Impact” (2025-11-26 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/deepgram/incidents/8xny9m4v24sr (CC BY 4.0).
- Markdown link: `[Deepgram: Shai-Hulud 2.0 Supply Chain Incident – No Customer Impact (2025-11-26)](https://rewindex.com/company/deepgram/incidents/8xny9m4v24sr)`


---
Canonical: https://rewindex.com/company/deepgram/incidents/8xny9m4v24sr · Markdown: https://rewindex.com/company/deepgram/incidents/8xny9m4v24sr.md · JSON: https://rewindex.com/api/v1/companies/deepgram/incidents/8xny9m4v24sr · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T16:14:16.876Z