Shai Hulud Supply Chain Attack Exploits CI/CD Pipelines for Cloud Credential Theft

A recent report from Fortinet's FortiGuard Labs details the ongoing "Shai Hulud" supply chain attack, which has been actively exploiting CI/CD pipelines to gain unauthorized access to cloud environments. The campaign, named after the giant sandworms from the Dune series, involves injecting malicious packages into software dependencies that execute during installation or continuous integration processes. These malicious payloads are designed to harvest crucial credentials from the build environment, including package registry tokens, GitHub tokens, AWS credentials, Kubernetes secrets, and SSH keys. Once obtained, these stolen credentials enable the attackers to autonomously republish additional poisoned packages, further propagating the threat. Fortinet observed a sharp increase in Shai Hulud worm instances during April and May 2026. The attack model is consistent: malicious package versions execute during CI jobs, steal credentials, and then facilitate further compromise. A notable incident involved an exploited Jenkins runner that matched the credential-harvesting pattern, leading to an escalation of privileges to full cloud admin, alteration of database network controls, and data exfiltration from Amazon Redshift. The key takeaway for organizations with modern CI/CD pipelines is the critical lesson that a compromised build dependency doesn't just affect the pipeline itself; it serves as a direct conduit into the production cloud. This emphasizes the need for robust security measures within the CI/CD process to prevent such supply chain attacks from becoming a bridge to sensitive production infrastructure. The report underscores that pipeline identity effectively equates to production identity, making the security of CI/CD pipelines paramount. FortiCNAPP played a crucial role in identifying affected AWS estates and reconstructing the timeline of the intrusion, demonstrating the importance of continuous monitoring and detection capabilities. The campaign, attributed to TeamPCP, has been targeting npm and PyPI packages since late 2025, indicating a persistent and evolving threat landscape for software supply chains.