Topic starter
20/01/2026 12:52 pm
TL;DR: Shai-Hulud immediately hunted CI/CD tokens, GitHub PATs, and cloud access keys, then used those NHIs to publish packages, reach private repositories, and expand into infrastructure, according to Hush Security. The attack validates that machine identities already hold the access attackers need, so lifecycle control and visibility now sit at the centre of software supply chain defense.
Editorial analysis by NHI Mgmt Group, based on content published by Hush Security: “Shai-Hulud 2.0: Why Attackers Hunt Machine Identities”.
Key questions
Q: What breaks when CI/CD workflow actions or build credentials are tampered with?
A: A poisoned workflow action can turn trusted automation into a credential-exfiltration path, especially when runners hold deployment tokens, cloud keys, or signing material.
Q: Why do automation tokens and GitHub PATs create such a large compromise window?
A: They create a large compromise window because they often outlive the task that created them and carry privileges broad enough to deploy, publish and access private assets.
Q: What are the signs that machine identity sprawl is becoming a supply chain risk?
A: Look for secrets stored outside a vault, repeated use of the same token across runners and repositories, and identities that can publish, deploy or read from multiple environments.
Practitioner guidance
- Inventory high-power automation credentials Map CI/CD tokens, GitHub PATs, cloud keys and publish tokens to the systems and privileges they unlock, then flag any identity that can deploy, publish or reach private repositories.
- Remove secrets from persistent build artefacts Search git history, CI caches, artifact directories and developer endpoints for valid credentials, then eliminate storage paths that let secrets survive beyond intended rotation.
- Reduce publish and workflow scopes Trim package publication rights, repository read access and workflow execution permissions so a single compromised identity cannot both spread and operate across the delivery chain.
Bottom line: Shai-Hulud demonstrated that attackers will go straight for the machine identities that already control publish, deploy and cloud access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 5:50 pm
NHI privilege concentration is now the primary supply chain risk: Shai-Hulud showed that the fastest path into a modern software estate is through the machine identities that already hold publish and deploy authority. That matters because many organisations still model supply chain risk as code integrity first and identity second. In practice, the identity layer is what gives attackers the ability to turn code access into infrastructure reach.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams limit the damage if a publish token or cloud key is stolen?
A: Constrain the identity so it cannot both publish artefacts and reach infrastructure, and separate repository access from deployment rights wherever possible. The goal is to keep one compromised secret from becoming a cross-environment foothold, especially in pipelines where trust is inherited through automation.
👉 Read our full editorial: Shai-Hulud showed why attackers target NHI power first