Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
Summary: GitGuardian researchers found in early August that a recent Shai-Hulud infostealer worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The article argues attackers no longer need to break trust relationships because they can use the credentials that already make those relationships work, and it cites GitGuardian's State of Secrets Sprawl research finding 28.65 million new hardcoded secrets added to public GitHub commits in 2025, a 34% year-over-year increase.
Bottom line: A package publishing credential turns credential theft into software distribution through a channel other developers and build systems automatically trust, so a single stolen token can propagate the attack forward. With 28.65 million new hardcoded secrets landing in public commits in 2025 alone, a finding list of that size is not a remediation plan until it is ranked by validity, privilege, and environment.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026