Notifications
Clear all
Topic starter
11/08/2026 3:14 pm
TL;DR: Shai-Hulud’s latest campaign affected more than 800 npm packages and roughly 2 billion monthly downloads by shifting execution into IDE and AI-agent configuration files, showing that supply-chain malware can persist even after lifecycle scripts are disabled, according to Backslash Security. The real control gap is not package installation alone but the trust granted to developer tooling, repository config, and local AI environments.
NHIMG editorial — based on content published by Backslash Security: Shai-Hulud’s New Frontier, covering how supply-chain worms hook into AI agents and IDEs
Questions worth separating out
Q: What breaks when AI coding agents are allowed to run Git operations on untrusted repositories?
A: The trust boundary breaks because the agent can trigger repository-local behaviour that was never meant to be safe by default.
Q: Why do AI agents and IDEs change the secret-management problem?
A: Because they operate inside the same environment as developer credentials, cloud tokens, and source-control access.
Q: What do security teams get wrong about package provenance and trusted publishing?
A: They often assume provenance replaces older authentication paths automatically.
Practitioner guidance
- Audit AI-agent and IDE hook files Review .vscode/tasks.json, .vscode/setup.mjs, .claude/settings.json, .claude/setup.mjs, and related repository configuration across all branches for unexpected execution paths.
- Rebuild developer environments from trusted images Do not rely on file deletion alone.
- Rotate every exposed secret immediately Assume cloud credentials, GitHub tokens, SSH keys, npm tokens, and AI service credentials have been compromised, then revoke and replace them before re-enabling developer access.
What's in the full article
Backslash Security's full blog post covers the operational detail this post intentionally leaves for the source:
- File-by-file examples of the malicious IDE and Claude Code hooks used to trigger execution.
- The specific credential locations and secret types the collector searched across developer environments.
- Repository and branch remediation steps that go beyond deleting infected files.
- The malware behaviours that complicate incident response and credential revocation.
👉 Read Backslash Security's analysis of Shai-Hulud's AI agent and IDE hook campaign →
AI agent hooks in developer tools: are your controls keeping up?
Explore further
11/08/2026 3:27 pm
AI agent hooks have become a software supply chain control point, not just a developer convenience. This campaign shows that local agent and IDE hooks can trigger code execution even after package-install vectors are reduced. That changes the governance problem from package hygiene to runtime trust in developer workflows. The practical conclusion is that AI tooling configuration belongs in the same control plane as source code and CI policy.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should organisations respond when a supply-chain worm reaches AI tooling?
A: Containment should include repository-wide scans, workspace rebuilds, credential revocation, and review of AI agent directories and hook files. If the malware can trigger from configuration, then cleanup must happen across code, developer machines, and identity systems before access is restored.
👉 Read our full editorial: AI agents and IDE hooks expand the software supply chain attack surface
