Security1 hOctober 10, 2026, 20:42

New Shai-Hulud worm scans 469 credential paths

A new variant of the Shai-Hulud infostealer checks 469 credential locations on developer machines, up 280 from the previous version's 189. The worm reads files the logged-in user can access, including MCP server and AI coding agent configs, and steals package-publishing tokens.

DEV Community

Open source

New Shai-Hulud worm scans 469 credential paths

Path count grew from 189 to 469, adding 280 new credential locations
Targets include .env files, shell history, CI/CD configs, CLI caches, IDE and AI tool settings
A token stolen from ~/.npmrc lets attackers distribute malware via trusted packages
GitGuardian counted 28.65 million new hardcoded secrets on public GitHub in 2025

#Shai-Hulud#GitGuardian#GitHub#Npm

Tensorlake npm package compromised to spread Shai-Hulud credential-stealing worm

Security

Shai-Hulud npm worm ran code just by opening a folder

Security

TanStack npm supply-chain attack: Mini Shai-Hulud worm hit 42 packages

Security

New Shai-Hulud worm scans 469 credential paths

Tensorlake npm package compromised to spread Shai-Hulud credential-stealing worm

Shai-Hulud npm worm ran code just by opening a folder

TanStack npm supply-chain attack: Mini Shai-Hulud worm hit 42 packages

ChainDrop npm Worm Hijacks 444 Packages with 2B Monthly Downloads