Shai-Hulud Payload Steals GitHub, npm, Cloud, CI/CD, and SSH Credentials From Developers

A new wave of malicious npm packages is targeting developers who work with cloud and serverless infrastructure.

The threat, known as the Shai-Hulud payload carrying the Hades malware family, has now expanded its reach to the Leo/RStreams ecosystem, a set of libraries widely used for AWS-native event streaming and data pipelines.

Security teams are raising the alarm as the attack quietly steals sensitive developer credentials the moment a package is installed.

What makes this campaign especially dangerous is how deep it digs. When a developer installs one of the affected packages, the payload begins collecting credentials stored across files, environment variables, shell history, GitHub CLI tokens, cloud access keys, and CI/CD pipeline secrets.

It works silently in the background and sends everything it finds to attacker-controlled GitHub repositories.

The scale of exposure is hard to ignore. The affected packages recorded roughly 45,000 downloads in a single month, meaning thousands of developers may have already been affected without knowing it.

Analysts at JFrog Security Research identified the new wave and published their findings in a report shared with Cyber Security News (CSN).

Researcher Yair Benamou noted this is not a completely new threat but another turn of the same campaign, with the same credential theft machinery but fresh targets and updated markers.

The Leo/RStreams libraries sit at the center of cloud-native development workflows. They wrap AWS services like Kinesis, S3, Lambda, and DynamoDB, meaning any developer installing these tools is likely working in an environment rich with cloud credentials and deployment tokens.

This positioning means that a single compromised install can expose far more than just one developer’s workstation. This latest wave confirms that the Shai-Hulud operation is still active and still growing.

Rather than building new malware from scratch, the attackers are recycling a proven payload and pointing it at new, trusted package families. Defenders who rely only on old campaign names or outdated signatures are still very likely to miss it entirely.

Shai-Hulud Payload Steals GitHub, npm, Cloud, CI/CD, and SSH Credentials

The malicious packages use a clever delivery trick that helps them slip past basic security scanners. Instead of placing harmful code inside the standard npm install scripts that most tools check, the attacker hides execution inside a file called binding.gyp.

When npm finds a package with this file and no explicit install script, it automatically runs node-gyp, which processes shell commands embedded inside that file. This gives the attacker a way to run code during installation while staying off the radar.

Once running, the payload collects credentials from a wide range of sources on the developer’s machine. It targets GitHub tokens, npm and PyPI publishing credentials, AWS access keys, JFrog and Artifactory tokens, and SSH keys.

Any stolen data is packaged into encrypted files and exfiltrated by creating repositories under a stolen GitHub token and committing the results there, a technique known as a GitHub dead drop.

Persistence and Lateral Movement Tactics

The payload does not stop at stealing credentials during installation. It plants several persistence hooks to keep running long after the initial install.

It sets itself up as a systemd service on Linux or a LaunchAgent on macOS, while also hooking into AI development tools by modifying configuration files for tools like Cursor, Copilot, and Gemini.

SSH keys found on the compromised machine are used to attempt lateral movement into other systems the developer has access to. The payload also injects itself into GitHub Actions workflows to dump pipeline secrets.

A single infected install on one machine could ripple outward into team repositories, cloud accounts, and production pipelines.

JFrog recommends isolating affected machines and CI runners before rotating any credentials. All persistence artifacts, including the monitor service, AI-tool hooks, and suspicious workflow files, must be removed first.

After cleanup, all GitHub, npm, cloud, SSH, Docker, and package registry credentials should be rotated. GitHub and npm accounts should also be audited for unexpected repositories, package releases, or suspicious workflow changes.

Indicators of Compromise (IoCs):-

Malicious npm Package Versions

Network and Service Indicators

Host and Persistence Indicators

Repository and Workflow Indicators

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.