TeamPCP’s open source leak turns Shai-Hulud into a copycat risk

At a glance

What this is: OXSecurity reports that TeamPCP has exposed Shai-Hulud source code on GitHub, and copycats are already modifying it and extending its reach.

Why it matters: Security teams that manage NHI, workload identity, and AI tool access need to treat source-code leakage as an amplification event, not just an incident artifact.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.

👉 Read OXSecurity's analysis of TeamPCP's leaked Shai-Hulud source code

Context

Shai-Hulud’s source code leak is a supply-chain and NHI problem at the same time. Once malware code, deployment instructions, and hook logic are public, the barrier to reuse drops sharply and defenders must assume the artifact will be repurposed across multiple GitHub accounts and downstream environments.

The primary governance issue is not simply that the malware exists. It is that credentials, repositories, and AI-assisted development environments can become distribution points when attacker infrastructure is exposed, copied, and iterated on in public. That makes identity governance, secrets handling, and code-hosting hygiene part of the same control plane.

Key questions

Q: What should security teams do when malware source code appears publicly on GitHub?

A: Treat the code as active threat infrastructure, not just intelligence. Track forks, clones, and modified versions, revoke any secrets or tokens tied to the campaign, and inspect repository provenance for compromised accounts. Public code can accelerate copycats, so containment must include code-hosting controls, identity review, and secret invalidation.

Q: Why does exposed malware source code increase organisational risk so quickly?

A: Public source code lowers the skill barrier for reuse and gives other attackers a ready-made template for delivery, persistence, and exfiltration. When repository content includes instructions or hooks, the malware becomes reusable infrastructure. That means the original compromise can multiply into several follow-on campaigns before defenders finish attribution.

Q: What do teams get wrong about secret theft in repository-driven attacks?

A: They often focus on the malware payload and miss the identity material that makes the payload work. Stolen tokens, keys, and account access are the real persistence layer, because they let attackers operate through legitimate systems. If the secrets remain valid, the attacker’s access remains valid too.

Q: How should organisations respond when AI coding tools are used as an execution surface?

A: Treat AI developer tooling like any other privileged runtime boundary. Review hooks, plugins, and local configuration for unauthorised script execution, and make sure those tools cannot reach sensitive secrets by default. If the tool can start code automatically, it needs the same trust review as build automation.

Technical breakdown

How malware source code turns into reusable attack infrastructure

When malicious code is published with instructions, it becomes more than evidence. It becomes an operating guide for other actors who can reuse payloads, modify loaders, and adapt delivery methods without rebuilding the attack chain from scratch. In this case, repository content, commit metadata, and fork activity all act as operational signals. The presence of deployment instructions lowers the skill threshold, while public hosting gives the attacker ecosystem a common reference point for iterative abuse. That is why code exposure matters even after the original campaign appears disrupted.

Practical implication: treat public malicious repositories as live threat infrastructure and monitor for forks, clones, and derivative code.

Why credential theft and repository access remain central to the Shai-Hulud pattern

The source article describes stolen credentials being uploaded to new GitHub repositories and sent to a predefined command-and-control server. That is a classic NHI abuse pattern because the identity material, not just the malware, becomes the transport for follow-on compromise. Once tokens, secrets, or account access are exposed, attackers can move from code possession to environment access. In practice, repository compromise often functions as both evidence and persistence, especially when commit history, account handles, and automation hooks are used to hide or extend activity.

Practical implication: prioritize secret revocation, token invalidation, and repository access review as soon as malicious code or credential handling is detected.

AI coding environments create a new execution surface for malicious hooks

The article notes code targeting Claude Code configurations by adding hooks that execute when the tool starts. That matters because developer AI tooling can become an execution surface, not just an assistant layer, if it reads local configuration files or invokes hooks automatically. The risk is not that the model itself is compromised in a narrow sense, but that adjacent configuration and runtime integration points can be abused to trigger malware behavior. For identity teams, this connects software development identity, secrets, and AI runtime trust into one control problem.

Practical implication: inventory AI developer tooling, inspect local hook paths, and apply the same trust review used for build and CI identities.

Threat narrative

Attacker objective: The objective is to turn a single malware family into a scalable, reusable ecosystem for credential theft, secret exfiltration, and wider compromise.

1. Entry occurred through compromised GitHub accounts that exposed TeamPCP and Shai-Hulud repositories to the public.
2. Credential abuse followed as stolen secrets were uploaded, reused, and sent to a predefined command-and-control server for further operations.
3. Impact expanded when the public code enabled copycats to fork, modify, and extend the malware without rebuilding it from scratch.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• SpotBugs Token GitHub Supply Chain Attack — Leaked SpotBugs personal access token triggers cascading GitHub supply chain attack across thousands of repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Public malware code is now an NHI governance problem, not only a threat-intelligence problem. Once attackers publish source code, the conversation shifts from a single intrusion to a reusable identity and secret-handling pattern. Repositories, tokens, and automation hooks become parts of the attacker workflow. Practitioners need to treat public code leakage as an identity event with downstream access implications.

Source-code leakage creates copycat acceleration, which changes the defender’s containment model. The article shows that other actors quickly modified the leaked code and expanded its reach. That means the damage curve is no longer linear with the original campaign. Instead, every exposed repository can seed additional variants, so incident response has to assume derivative abuse, not just one malicious actor.

Credential upload to public repositories is the modern persistence layer for malware operators. The source article describes stolen secrets being pushed to GitHub and routed to a predefined C2 server. That is a standing-privilege failure mode in which identity material outlives the original compromise path. The practical conclusion is that exposed secrets often become the true control surface of the incident.

AI developer environments widen the blast radius when malware targets tool startup hooks. The article’s mention of Claude Code configuration abuse shows that AI-assisted development tools can be turned into execution points if local trust is too broad. That does not make every AI tool an autonomous actor, but it does mean the identity boundary now includes model-adjacent configuration and runtime integration. Teams should govern those surfaces as part of software supply chain security.

GitHub account compromise and malware distribution are now tightly coupled. The report describes multiple accounts potentially affiliated with the leak, plus future-dated commits and public forks. Those artefacts point to identity misuse wrapped in social and operational obfuscation. The broader lesson is that account legitimacy, repository provenance, and code execution cannot be evaluated separately in active malware ecosystems.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: 38% of secrets incidents in collaboration and project management tools like Slack, Jira, and Confluence are classified as highly critical or urgent, according to The State of Secrets Sprawl 2025.
• Forward pivot: For broader breach patterns and root-cause analysis across exposed credentials, see The 52 NHI breaches Report.

What this signals

Secret exposure now behaves like a distribution event. Once malware code and supporting credentials are public, the governance problem shifts from containment to propagation control, which is why credential monitoring, repository scanning, and rapid revocation need to operate together. The attack surface also extends into AI-assisted development workflows, where hooks and startup paths can become hidden execution points.

With 4.6% of all public GitHub repositories containing at least one hardcoded secret, organisations should assume the same ecosystem that stores code also leaks identity material at scale. That makes code-hosting hygiene a core part of IAM and NHI governance, not a separate developer concern.

For practitioners

• Track public forks of malicious repositories Monitor GitHub for cloned or modified versions of leaked malware code and alert on derivative repositories, new branches, and rapid commit activity that indicates copycat adoption.
• Revoke exposed secrets immediately Invalidate any tokens, API keys, and credentials found in source-code repositories or related malware artefacts before analysing attribution or intent, because reusability drives the blast radius.
• Inspect AI developer hook paths Review local configuration, startup hooks, and extension points in tools like Claude Code for unauthorised execution logic, especially where those paths can read secrets or trigger scripts.
• Separate repository access from build trust Require distinct controls for code hosting, package publication, and build execution so a compromised GitHub account cannot automatically become a malware distribution channel.

Key takeaways

• The article shows that leaked malware source code can become an operational asset for copycats, which turns one intrusion into a wider ecosystem risk.
• Public secret exposure remains the critical accelerant, because valid credentials can be abused within minutes and are often the real persistence layer.
• Teams should govern repositories, tokens, and AI developer hooks as one identity boundary if they want to contain this pattern effectively.

Key terms

• Source-code leak as an attack multiplier: A source-code leak is more than evidence of compromise when the code contains deployment logic, hooks, or operational instructions. It becomes an attack multiplier because other actors can copy, modify, and redeploy the technique without rediscovering the method themselves.
• Credential reuse persistence: Credential reuse persistence occurs when stolen tokens, keys, or accounts remain valid after the original compromise path is discovered. The attacker no longer needs the initial intrusion because the identity material itself keeps the access alive, often across multiple systems and repositories.
• AI tool startup hook abuse: AI tool startup hook abuse happens when malicious code is placed in configuration or extension points that execute when the tool launches. In practice, the tool becomes a runtime trigger for attacker logic, which widens the boundary of software supply chain trust.

What's in the full analysis

OXSecurity's full article covers the operational detail this post intentionally leaves for the source:

• Repository-level indicators and live monitoring cues for TeamPCP-linked forks and clones
• Code excerpts showing how the malware uploads stolen credentials and routes them to command-and-control
• The GitHub account artefacts, commit patterns, and repository signals that support attribution analysis
• Specific hooks targeting Claude Code configurations and startup behaviour

👉 OXSecurity's full post covers the GitHub artefacts, account signals, and malware hooks in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.