GitHub account compromise and Shai-Hulud: what IAM teams missed

TL;DR: An attacker hijacked a gpt-pilot co-founder’s GitHub account, force-pushed a Shai-Hulud credential stealer into main, and was stopped only because ruff CI failed twice on formatting and linting errors. The case shows how repository access, branch protection, and developer-tool persistence now function as NHI governance controls, according to StepSecurity.

NHIMG editorial — based on content published by StepSecurity: LLMjacking: How Attackers Hijack AI Using Compromised NHIs

By the numbers:

• The attacker attempted access within an average of 17 minutes after AWS credentials are exposed publicly, and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: What breaks when a package maintainer account is compromised?

A: When a maintainer account is compromised, the attacker inherits trusted publishing rights and can turn legitimate release channels into malware distribution paths.

Q: Why do GitHub repositories create NHI risk for IAM teams?

A: GitHub repositories create NHI risk because they often contain the credentials and automation identities that actually touch production systems.

Q: How do security teams know if branch protections are actually working?

A: They should test whether a compromised or over-privileged account can still rewrite history, skip review, or publish code without passing required checks.

Practitioner guidance

• Lock down default branches Require pull request reviews, required status checks, and blocked force pushes on every production repository.
• Treat maintainer accounts as privileged identities Apply stronger access governance to repository owners and release managers than to ordinary contributors.
• Scan developer workflows for persistence hooks Check editor tasks, local agent settings, repo hooks, and module import paths for unexpected execution points.

What's in the full analysis

StepSecurity's full post covers the operational detail this analysis intentionally leaves for the source:

• The exact commit timeline, force-push sequence, and CI failure points that blocked the malware.
• The full payload breakdown, including the GitHub commit C2 channel and Sigstore abuse path.
• The file hashes, commit SHAs, and indicators of compromise needed for detection and response.
• The repository-level recovery steps for confirming exposure and rotating affected credentials.

👉 Read StepSecurity's analysis of the gpt-pilot Shai-Hulud compromise →

GitHub account compromise and Shai-Hulud: what IAM teams missed?

Explore further

View Full Forum →  |  NHI Foundation Course →