In early August, GitGuardian researchers discovered that a recent variant of the Shai-Hulud infostealer worm had evolved to scan for credentials across 469 locations throughout developer environments, CI/CD tooling, cloud configurations, and AI tool configs. Earlier versions of the infostealer worm only checked 189 paths. The expansion reflects a broader shift in attacker strategy: rather than attempting to break trust relationships, attackers are now exploiting the credentials that already make those relationships function.
The jump from 189 to 469 targeted paths represents more than a numerical increase—it reveals how credential harvesting malware creators keep broadening the search radius. Credentials now appear in expected places like .env files, shell history, and package-manager configuration, but also in CLI caches, CI/CD configurations, IDE settings, and increasingly in the configuration used by AI development tools. GitGuardian's State of Secrets Sprawl research found 28.65 million new hardcoded secrets added to public GitHub commits in 2025 alone, a 34% year-over-year increase. A token found on a developer workstation might open access to source code that likely contains cloud credentials, which would grant access to infrastructure, while a GitHub token might allow write access to additional repositories.
According to the report, package publishing credentials deserve special attention because they turn credential theft into software distribution, forward propagating the attack. The report emphasizes that organizations maintaining packages should identify where publishing tokens exist and determine whether standing credentials are still necessary, with that search extending beyond repositories. GitGuardian researchers note that security and development teams need visibility into where package publishing credentials actually accumulate, followed by a plan to remove them. The report states that "the hardest publishing credential for an attacker to steal is one that does not exist," but if they must exist, the shorter the window access can be granted, the better.
The report explains that Shai-Hulud belongs to a growing class of supply chain attacks that search compromised environments for credentials they can use to continue the attack. Credentials become the connective tissue between one compromised environment and the next, with package publishing credentials creating a path to propagation by turning tokens that developers use to publish into authority over a trusted package that other developers, build systems, and organizations will automatically consume. A credential discovered in staging may still authenticate against production, while a token copied into a developer's local environment may retain privileges meant for automation. The report notes that a single developer can authenticate to GitHub, npm, AWS, Kubernetes, internal APIs, and build infrastructure in one normal day, and CI/CD pipelines often carry an equally diverse set.
GitGuardian recommends that organizations move package publishing toward short-lived, identity-backed mechanisms wherever supported, with OIDC-based trusted publishing as one example. The report outlines a three-priority approach: first, remove package publishing keys from cleartext; second, remove exposed production credentials; and third, rank every remaining exposed secret by risk. The report concludes that the next Shai-Hulud variant will almost certainly look somewhere new, expanding past that 469 number, and that organizations win not by memorizing every place the next infostealer might look but by removing standing privilege and eliminating exposed credentials everywhere they exist. The shift from perimeter defense to credential risk management suggests that traditional security boundaries no longer align with how modern software gets built, and that organizations will need to rethink access control as a continuous cycle rather than a one-time hardening exercise.