Attacker Hijacks AI Coding Assistant Session and Spreads Shai-Hulud Across 100 Repositories

A threat actor compromised an active AI coding-assistant session at an unnamed software-as-a-service (SaaS) provider and turned the trusted development workflow into an entry point for a major software supply-chain attack.

According to Mandiant, the compromised assistant recommended attacker-poisoned software to a developer. Once the recommendation was accepted, the attacker used the foothold to install information-stealing malware through a malicious PyPI package, steal GitHub OAuth tokens and ultimately deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories.

The attackers also poisoned a package inside the organization's own official namespace. Another employee later downloaded the compromised package, triggering a second infection.

The incident demonstrates an emerging security challenge: AI development assistants are becoming part of the software supply-chain attack surface.

Attack at a Glance

Detail	Information
Attack Type	Software supply-chain compromise
Initial Vector	Hijacked AI coding-assistant session
Malware	Shai-Hulud
Victim	Unnamed SaaS provider
Repositories Affected	Approximately 100 internal repositories
Package Ecosystem	PyPI involved in initial malware delivery
Credentials Stolen	GitHub OAuth tokens
Data Targeted	Repository secrets and product source code
Secondary Infection	Poisoned package in company's official namespace
Threat Actor	Not publicly identified
AI Assistant	Not publicly identified

Mandiant has deliberately left several important details undisclosed, meaning the incident should not currently be attributed to a particular AI product, SaaS provider or threat group.

How the Attack Unfolded

The incident began when an attacker obtained control of an active AI coding-assistant session.

Exactly how the session was hijacked has not been publicly disclosed.

Once inside the development workflow, the attacker was able to influence the assistant so that it recommended software that had already been poisoned.

The developer accepted the recommendation.

From there, the attack expanded rapidly:

AI coding-assistant session compromised

↓

Assistant recommends attacker-poisoned software

↓

Developer accepts recommendation

↓

Malicious PyPI package installs infostealer

↓

Repository secrets and source code targeted

↓

GitHub OAuth tokens stolen

↓

Shai-Hulud introduced

↓

Worm spreads across ~100 internal repositories

↓

Official internal package poisoned

↓

Second employee downloads compromised package

↓

Additional infection occurs

This sequence demonstrates how a single trusted development interaction can potentially become an organization-wide supply-chain incident.

Poisoned PyPI Package Delivers Infostealer

After the malicious recommendation was accepted, the attacker used a poisoned package from the Python Package Index (PyPI) to install information-stealing malware.

Developer environments are attractive targets because they frequently contain credentials capable of accessing highly sensitive infrastructure.

Depending on the developer's role, a workstation or development environment may contain:

• GitHub authentication tokens
• Repository credentials
• Cloud API keys
• CI/CD credentials
• Package-publishing tokens
• SSH keys
• Container-registry credentials
• Infrastructure-as-code secrets
• Source code
• AI development configuration

In this case, Mandiant specifically reported the theft of GitHub OAuth tokens, repository secrets and source code associated with the company's products.

Shai-Hulud Spreads Across About 100 Repositories

After obtaining the necessary access, the attacker deployed Shai-Hulud, a malware family known for worm-like propagation through software-development environments.

Approximately 100 internal repositories were affected in the incident.

The worm's ability to steal development credentials creates an especially dangerous feedback loop:

Repository compromised

→ Secrets discovered

→ Additional credentials stolen

→ More repositories accessed

→ Malware inserted

→ Additional secrets exposed

→ Propagation continues

This makes developer credentials particularly valuable because one token can potentially provide access to multiple projects or services.

What Is Shai-Hulud?

Shai-Hulud emerged as a significant software-supply-chain threat in 2025.

Earlier variants targeted the npm ecosystem and demonstrated worm-like behavior by harvesting credentials and using compromised package-publishing access to infect additional packages.

Wiz reported in 2025 that Shai-Hulud compromised more than 100 packages and attempted to steal sensitive information before exfiltrating data through attacker-created GitHub repositories.

The malware family has continued evolving.

In August 2026, another campaign compromised the keyv and cacheable npm ecosystem and propagated to more than 400 packages.

That campaign targeted cloud credentials, developer secrets, CI/CD environments, cryptocurrency wallets and AI-related configuration files. It also attempted persistence through Claude Code hooks and Visual Studio Code tasks.json configurations.

These campaigns are related through the Shai-Hulud malware family, but available evidence does not establish that the August campaign and the unnamed Mandiant SaaS incident were conducted by the same attacker.

Internal Package Poisoning Causes a Second Infection

One of the most concerning parts of the incident occurred after the initial repository compromise.

The attacker poisoned a package published within the SaaS provider's official package namespace.

Another employee subsequently downloaded the compromised version.

That resulted in another infection.

This illustrates a dangerous characteristic of software-supply-chain attacks:

Once attackers compromise an organization's trusted development infrastructure, they can potentially turn legitimate internal software distribution mechanisms into malware-delivery channels.

The victim receiving the malicious package may have little reason to suspect anything is wrong because the package appears to originate from a trusted organizational source.

AI Coding Assistants Are Becoming Security Principals

AI coding assistants are increasingly capable of doing much more than generating code.

Depending on their configuration, modern development agents may be able to:

• Read project files
• Modify source code
• Execute terminal commands
• Install dependencies
• Interact with Git repositories
• Call external APIs
• Access development tools
• Read configuration files
• Operate through extensions
• Interact with CI/CD workflows

These capabilities can significantly improve developer productivity.

But they also mean the AI agent may effectively operate with the permissions of the developer using it.

If the developer has broad repository access and the assistant can act within that environment, compromising the assistant session can provide attackers with a powerful operational foothold.

The Recommendation Itself Became the Attack Vector

One of the most important lessons from the incident is surprisingly simple:

An AI recommendation should not automatically be considered trustworthy.

Developers commonly ask coding assistants to recommend:

• Libraries
• Frameworks
• npm packages
• PyPI packages
• GitHub repositories
• APIs
• Code snippets

Attackers can attempt to exploit this trust.

In this incident, the coding assistant recommended software that had already been poisoned, and the developer accepted the recommendation.

That makes dependency verification increasingly important in AI-assisted development.

The security question should not be:

“Did the AI recommend this package?”

It should be:

“Has this dependency been independently verified and approved?”

AI Assistants Should Not Have Unrestricted Access to Secrets

The theft of GitHub OAuth tokens also demonstrates why AI development environments should not have unnecessary access to long-lived credentials.

Mandiant recommends keeping raw API keys, long-lived OAuth tokens and other sensitive credentials outside the direct reach of extensions and AI-assisted development tools.

Instead, organizations should prefer:

• Short-lived credentials
• Minimum required permissions
• Secret-management platforms
• Repository-level access controls
• Strong auditing

If a coding assistant becomes compromised, the goal should be to ensure the session cannot automatically access credentials capable of compromising an entire organization.

Control AI-Recommended Dependencies

Mandiant recommends validating third-party dependencies recommended by AI tools against approved allowlists and cryptographic checksums.

Organizations can implement controls such as:

AI recommends package

↓

Package checked against approved registry

↓

Publisher and version verified

↓

Checksum/signature validated

↓

Security scanning performed

↓

Package permitted into build environment

This creates a security checkpoint between the AI recommendation and actual code execution.

Route Dependencies Through Internal Repositories

Organizations should also avoid allowing every developer workstation or AI coding agent to retrieve arbitrary dependencies directly from public repositories.

Mandiant recommends routing dependency traffic through controlled internal repositories.

For example:

Developer / AI Assistant

↓

Internal package repository

↓

Security validation

↓

Approved external packages

↓

Public npm / PyPI ecosystem

An internal repository or package proxy can provide a central location for:

• Malware scanning
• Dependency approval
• Version control
• Package signing
• Logging
• Blocking known malicious packages
• Software composition analysis

It also gives security teams a valuable monitoring point for unusual dependency activity.

What Security Teams Should Hunt For

Organizations using AI-assisted development should monitor both the AI environment and traditional developer infrastructure.

Useful indicators include:

• Unexpected PyPI or npm package installations
• New dependencies suggested shortly before suspicious activity
• Unknown packages appearing in build environments
• Unexpected GitHub OAuth token use
• Repository access from unusual systems or locations
• Sudden modifications across multiple repositories
• Unexpected GitHub Actions changes
• New CI/CD workflows
• Unauthorized package publishing
• Changes to internal package namespaces
• Secrets appearing in unexpected processes
• AI assistants executing unusual terminal commands
• Unexpected access to credential stores
• New Claude Code hooks
• Suspicious VS Code tasks.json changes
• Public repositories unexpectedly created for data exfiltration

Security teams should particularly investigate situations where one developer identity suddenly modifies many repositories in a short period.

If Shai-Hulud Is Detected

Organizations finding evidence of Shai-Hulud should assume that developer credentials may have been exposed.

Incident response should include:

1. Isolate affected developer systems.
2. Revoke compromised GitHub OAuth tokens.
3. Rotate repository credentials.
4. Rotate package-publishing tokens.
5. Rotate exposed cloud credentials.
6. Review CI/CD secrets.
7. Audit recently modified repositories.
8. Inspect package-publishing history.
9. Search for malicious dependencies.
10. Review internal package registries.
11. Remove unauthorized AI-agent persistence.
12. Review GitHub Actions and CI/CD workflows.
13. Determine whether source code was exfiltrated.
14. Identify downstream users who downloaded compromised packages.

Organizations should also identify packages published during the compromise window and determine whether they were distributed outside the company.

Security Takeaway

The Shai-Hulud incident highlights an important change in software-supply-chain security.

Developers previously had to worry about:

Compromised dependencies

Malicious packages

Stolen GitHub credentials

CI/CD compromise

Repository poisoning

Those threats have not disappeared.

Now organizations must add another potential attack surface:

AI coding assistants.

In the Mandiant case, an attacker compromised an active coding-assistant session, influenced a software recommendation, delivered an infostealer through a poisoned PyPI package, stole GitHub OAuth tokens and ultimately spread Shai-Hulud across roughly 100 internal repositories.

The incident does not mean organizations should stop using AI coding assistants.

It means those assistants should be treated as privileged participants in the software-development environment.

Their access should be limited, their actions monitored, their recommended dependencies independently verified and their ability to reach sensitive credentials carefully controlled.

As AI agents gain greater autonomy to install packages, execute commands and modify repositories, AI development security and software supply-chain security are increasingly becoming the same problem.