Worm Hijacks AI Agents, Steals Dev Secrets

A new wave of the Shai-Hulud worm has compromised over 170 npm and PyPI packages, posing a significant threat to development environments. This malware harvests a broad spectrum of credentials, including AWS keys, SSH private keys, and tokens for various services. Uniquely, it targets AI agent configurations from tools like Claude and Kiro, treating them as trusted execution environments.

The worm establishes persistence through hooks in AI coding agents and system daemons, ensuring re-execution upon project opening and surviving reboots. It bypasses robust security measures like signed provenance and two-factor authentication by exploiting a novel technique involving orphaned commits, which manipulates GitHub Actions workflows. The campaign rapidly expanded from 42 packages to 172 within 48 hours.

The attack chain involved poisoning GitHub Actions caches and extracting OIDC tokens for direct package publishing, even when tests failed. This allowed malicious versions to reach registries like npmjs.org. Mitigations like lockfile enforcement on npm do not prevent Python import-time execution, facilitating cross-ecosystem spread.

Developers are advised to immediately check for malicious files and persistence artifacts. Security directors must rotate credentials, audit CI/CD workflows, and treat AI coding agent configurations as sensitive credential stores. The worm's code has reportedly been open-sourced, increasing the potential for wider exploitation by various threat actors.