Notifications
Clear all
Topic starter
11/08/2026 3:11 pm
TL;DR: A new Shai-Hulud variant compromised over 440 npm packages and reached an estimated 2 billion monthly downloads, while five malicious GitHub repositories and 3,800 credential-dump repos remained active days later, according to OXSecurity. The pattern shows that supply chain worms now exploit MCP, IDE settings, and maintainer trust faster than platform cleanup can contain them.
NHIMG editorial — based on content published by OXSecurity: 5 days after 440+ npm packages were compromised, 5 malicious repositories remain live in the wild
By the numbers:
- 3,800+ public GitHub repositories containing exfiltrated credential dumps remain publicly accessible and searchable.
- Two malicious npm packages stayed live for 72 hours after initial infection in the npm registry.
Questions worth separating out
A: Security teams should treat cloned repositories as untrusted execution inputs and gate any workspace settings, post-clone scripts, or agent-triggered actions behind review and allowlisting.
Q: Why do developer secrets make supply chain incidents much harder to contain?
A: Because developer secrets often act like non-human identities with broad runtime reach.
Q: What do security teams get wrong about MCP plugin risk?
A: Teams often treat plugins as if they were ordinary extensions, when in practice they can become trust-bearing execution components.
Practitioner guidance
- Harden repository-open trust decisions Block automatic execution from cloned repositories unless workspace settings, post-clone hooks, and agent actions are explicitly reviewed.
- Inventory and rotate developer secrets aggressively Find developer tokens, cloud credentials, and session keys that can authenticate into build and cloud systems, then move them to short-lived, scoped credentials with rapid revocation paths.
- Add MCP onboarding controls Require provenance checks for MCP servers, inspect linked repositories for malicious settings files, and gate new tool access behind an allowlist process before coding assistants can consume them.
What's in the full report
OXSecurity's full article covers the operational detail this post intentionally leaves for the source:
- Repository-level evidence showing which infected GitHub projects remained active days after infection
- The exact malicious settings-file pattern used to trigger Claude Code and VS Code execution
- The live MCP server path that linked a clean package to a malicious repository payload
- The authors' detection and takedown observations across npm and GitHub
👉 Read OXSecurity's analysis of the Shai-Hulud worm, MCP abuse, and active GitHub exposure →
Shai-hulud in MCP and GitHub: what developers should watch now?
Explore further
11/08/2026 3:26 pm
Developer tooling has become an identity attack surface. The article shows that repository cloning, workspace settings, and AI coding assistants can execute attacker-controlled instructions and expose secrets without a classic vulnerability exploit. That shifts the control problem from code review alone to identity-aware trust in development workflows. Practitioners should treat local developer tooling as part of the NHI and secrets governance boundary.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: How should organisations respond when malicious repositories are still live after detection?
A: They should assume the exposure window is still open, rotate any secrets that may have been harvested, and isolate developer accounts that could have been used for propagation. The practical test is whether the organisation can invalidate affected credentials faster than the attacker can reuse them. That is the difference between detection and containment.
👉 Read our full editorial: Shai-hulud shows how MCP and GitHub become worm channels
