Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: Shai-Hulud 2.0’s npm worming and CVE-2025-62221’s active exploitation show how quickly exposed code paths, CI/CD runners, and unpatched endpoints can turn into enterprise-wide compromise, according to FireCompass. The operational lesson is that external attack surface control now matters as much as internal detection, because attacker dwell time is collapsing.
NHIMG editorial — based on content published by FireCompass: Weekly Report on New Hacking Techniques and Critical CVEs, 2 Dec to 10 Dec 2025
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
A: Postinstall hooks turn package installation into code execution, so any compromised dependency can run immediately on developer laptops and build runners.
Q: Why do exposed NHI credentials create such a large blast radius?
A: Exposed NHI credentials create a large blast radius because they are usually tied to service permissions, automation paths, and adjacent cloud resources.
Q: How should security teams reduce malicious package risk in CI/CD pipelines?
A: Use allowlisting, signed artifacts, isolated build runners, and ephemeral credentials that expire after the job completes.
Practitioner guidance
- Restrict install-time execution in software pipelines Block or review package lifecycle scripts in high-risk repositories and build environments, especially where third-party dependencies can execute during installation.
- Tighten token scope and runner governance Limit GitHub and CI/CD tokens to the minimum required permissions, and require approval for self-hosted runner registration and workflow file changes.
- Inventory and rotate exposed secrets quickly Continuously scan code, logs, and build artefacts for API keys, cloud credentials, and GitHub tokens, then revoke and rotate them as soon as exposure is detected.
What's in the full article
FireCompass's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step analysis of Shai-Hulud 2.0’s CI/CD worming behaviour across npm, GitHub Actions, and self-hosted runners.
- Technical breakdown of CVE-2025-62221 exploitation conditions and the privilege escalation path to SYSTEM.
- Operational guidance on how FireCompass frames external attack surface discovery for exposed endpoints and developer infrastructure.
- The report’s incident-response takeaways for organisations dealing with compromised runners, leaked secrets, or active endpoint exploitation.
👉 Read FireCompass’s weekly report on Shai-Hulud 2.0, CVE-2025-62221, and DDoS TTPs →
Shai-Hulud 2.0 and CVE-2025-62221: what teams need to prioritise?
Explore further
06/09/2026 5:19 pm
Supply chain malware is now an NHI governance issue, not only an AppSec problem. When malicious packages harvest tokens and reuse them to mutate repositories, the real control failure is unmanaged machine identity lifecycle. Secrets in code behave like credentials with no revocation discipline, which is exactly why NHI governance must extend into build systems and developer workflows. Practitioners should treat package trust as identity trust.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys.
A question worth separating out:
A: When a vulnerability is publicly exploited, internet-facing, or connected to high-value identity paths, it should move ahead of routine backlog work. The goal is to reduce the attacker’s viable window, especially when third-party access or privileged identities could turn that exposure into lateral movement. Prioritisation should reflect exploitability and blast radius, not patch age alone.
👉 Read our full editorial: Shai-Hulud 2.0 and CVE-2025-62221 sharpen external attack surface risk
