Shai-Hulud Returns: The npm Worm That Only Works Because Your Secrets Are Standing Still

Summary

The recent Shai-Hulud supply chain attack demonstrates a fundamental shift in how attackers compromise organizations. Rather than exploiting software vulnerabilities, the malware targets what already exists on developer workstations and CI/CD systems: long-lived credentials. From .env files and cloud credentials to HashiCorp Vault tokens and AI coding assistants, the attack succeeds because secrets remain static, discoverable, and reusable. The lesson is clear: reducing standing privileges, adopting just-in-time credentials, and moving toward secretless authentication dramatically reduces the attacker’s blast radius.

Why Is the Shai-Hulud Attack Different from Previous Supply Chain Attacks?

On August 4, 2026, attackers compromised the GitHub account of the maintainer behind the popular keyv npm package family and distributed a credential-stealing worm across hundreds of packages. Within a day, researchers at Aikido Security reported that more than 400 infected packages, representing over two billion monthly installs, had been affected.

Unlike many high-profile supply chain attacks, Shai-Hulud doesn’t depend on exploiting vulnerable software.

Instead, it assumes something much simpler: Your secrets are already sitting on disk.

The malware executes automatically during package installation through a malicious preinstall script, searches the local system using hundreds of file patterns, and harvests whatever credentials it finds.

That includes:

• .env files
• AWS credentials
• SSH private keys
• Kubernetes kubeconfigs
• Terraform state files
• npm and GitHub tokens
• VPN configurations
• Database credentials
• Developer workstation artifacts

The attack isn’t breaking security controls.

It’s taking advantage of credentials that were already available.

Why Are Standing Credentials Becoming the Real Attack Surface?

One of the most striking aspects of the malware is how specifically it targets secrets infrastructure.

Rather than searching only for generic credentials, Shai-Hulud includes dedicated logic for locating HashiCorp Vault tokens.

It checks multiple well-known locations, including environment variables, home directories, CI runners, Kubernetes workloads, and container paths, and, when successful, attempts to enumerate every KV mount before reading every accessible secret.

The malware applies the same strategy to AWS Secrets Manager and Kubernetes secrets.

One compromised machine.

One standing credential.

Potentially an entire secrets estate exposed.

Importantly, this does not represent a compromise of HashiCorp Vault itself.

It demonstrates something more fundamental:

A long-lived bearer token stored on an endpoint becomes the weakest link in the security chain.

What Does AI Have to Do with This Attack?

Perhaps the most forward-looking aspect of Shai-Hulud is its persistence mechanism.

Using stolen GitHub credentials, the malware modifies developer tooling by inserting malicious hooks into configuration files such as:

• .claude/settings.json
• .vscode/tasks.json

The result is persistent execution every time a developer opens the repository or starts an AI-assisted coding session.

This is an important shift.

AI coding assistants are rapidly becoming part of every development workflow.

If these agents hold credentials, or can directly access production systems, they become another credential repository waiting to be compromised.

The AI development environment is now part of the enterprise attack surface.

What Does This Incident Teach Us About Modern Identity Security?

Every stage of the attack depends on a single assumption:

A long-lived secret exists somewhere on the machine.

Remove that assumption, and the attack’s blast radius and opportunities for privilege escalation are dramatically reduced.

This is why organizations are increasingly moving beyond traditional secrets management toward Runtime Identity Security.

Rather than protecting static credentials forever, the objective becomes reducing, or eliminating, the amount of standing privilege available to attackers.

That includes:

• replacing static credentials with Just-in-Time dynamic secrets
• using identity-based authentication instead of shared tokens
• eliminating credentials from developer workstations
• reducing secret lifetime to minutes instead of months

If attackers steal an ephemeral credential that expires within minutes, the window for exploitation becomes dramatically smaller.

How Can Organizations Reduce the Blast Radius of Attacks Like Shai-Hulud?

There is no single technology that makes organizations immune to credential theft.

Even on a compromised workstation, credentials currently in use may still be exposed.

The goal is to minimize what can be stolen, and how useful stolen credentials remain.

Organizations should focus on four priorities:

1. Eliminate static credentials wherever possible

Move secrets out of configuration files and environment variables.

Replace long-lived credentials with dynamic secrets issued only when needed. The same principle applies to CI/CD pipelines, where secrets should be fetched at runtime, scoped only to the executing job, and never exposed as long-lived environment variables.

2. Replace shared tokens with workload identity

Machine authentication through cloud IAM, Kubernetes identities, OIDC, or Akeyless Universal Identity eliminates predictable token files that commodity malware is designed to locate, helping organizations address the Secret Zero problem by replacing standing credentials with identity-based authentication.

3. Centralize visibility across all secret stores

Most enterprises operate multiple vaults and cloud-native secret managers.

Akeyless Multi-Vault Governance provides a single control plane across AWS Secrets Manager, Azure Key Vault, Google Cloud Secret Manager, Kubernetes Secrets, and HashiCorp Vault, enabling security teams to discover, govern, and rapidly rotate credentials across every environment following an incident.

4. Extend Zero Standing Privileges to AI agents

AI assistants should never permanently hold production credentials.

Akeyless SecretlessAI and Agentic Runtime Authority ensure AI agents hold zero credentials and receive ephemeral access only at execution time through the Akeyless Gateway. Combined with policy-based authorization, even a compromised coding assistant has no credentials to steal and nowhere to move laterally.

Why Does Architecture Matter as Much as Credential Management?

Reducing standing privileges is only one part of the equation.

Equally important is protecting the secrets that organizations must continue to manage.

The Akeyless Identity Security Platform combines centralized secrets governance with Zero-Knowledge Architecture, powered by patented Distributed Fragments Cryptography (DFC™).

Instead of storing complete encryption keys in one place, Akeyless’s patented Distributed Fragments Cryptography (DFC™) distributes key fragments so that no single party, including Akeyless, can reconstruct customer secrets, eliminating the centralized master key that attackers traditionally target.

Combined with dynamic secrets, machine identity, automated rotation, and secretless authentication, this architecture helps reduce both credential exposure and attack blast radius.

The objective isn’t simply storing secrets more securely.

It’s fundamentally reducing the opportunities attackers have to misuse them.

What Should Security Teams Do Immediately?

Organizations evaluating potential exposure should prioritize the following actions:

• Review dependency trees and published indicators of compromise.
• Assume any credentials accessible from affected machines may have been exposed.
• Rotate credentials broadly rather than targeting only individual secrets.
• Review AI coding assistant configurations and development workstation persistence mechanisms.
• Begin reducing reliance on standing credentials across developer and CI/CD environments.

The faster organizations move toward runtime-issued identities and ephemeral credentials, the smaller the impact of the next supply chain attack becomes.

The Bottom Line

Shai-Hulud is unlikely to be the last malware family designed to harvest developer credentials.

In many ways, it represents the future of supply chain attacks: malware that doesn’t need software vulnerabilities because credentials already provide the access attackers want.

The lesson isn’t simply to rotate secrets after an incident.

It’s to redesign identity so there are fewer standing secrets available to steal, and any credentials that are exposed have a significantly smaller blast radius.

We also want to acknowledge Aikido Security for responsibly disclosing and documenting this attack, helping the security community respond quickly and effectively.

Ready to Reduce Your Standing Credentials?

Shai-Hulud demonstrates that attackers are increasingly targeting identities instead of software vulnerabilities.

If your organization is evaluating how to reduce standing privileges, automate credential rotation, implement dynamic secrets, or secure AI-driven development workflows, schedule a personalized demo with Akeyless to see how Runtime Identity Security can help minimize credential exposure across hybrid and multi-cloud environments.

Request a demo today.

Frequently Asked Questions