Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches

A routine software update can now open the door to a cloud breach. Attackers are hiding credential stealing malware inside trusted packages and development tools, allowing malicious code to run on developer computers and automated build systems before an application even starts.

The threat spans several campaigns rather than one malware family. Shai-Hulud emerged in September 2025, while later operations targeted additional programming ecosystems and security tools.

Once attackers obtain working credentials, they can access cloud storage, inspect infrastructure, steal data, or establish lasting access. Qualys researchers noted this recurring pattern in their September 28 analysis.

Qualys said in a report shared with Cyber Security News (CSN) that developer environments and cloud infrastructure must be treated as one connected attack surface, not separate security problems.

Developer machines often hold cloud access keys, repository tokens, publishing credentials, and private keys. As attacks on SAP packages illustrate, stealing those secrets can expose systems far beyond the original software project, even when the compromised application never reaches production.

Supply Chain Attacks Turn Developer Machines

The decisive step happens during installation. Package managers can run scripts automatically, giving attackers access to the same files, environment variables, and credentials available to the developer or build job.

Normal application protections may not engage before the theft has already occurred. Shai-Hulud initially searched infected environments for cloud credentials and uploaded stolen information to public GitHub repositories created under victims’ accounts.

A November variant added backdoor functions and destructive behavior when credential theft failed, increasing the consequences of a compromised dependency.

By May 2026, Mini Shai-Hulud was using scripts that execute before installation completes. Qualys reported that the May 19 wave compromised 639 package versions across 323 packages.

Coverage of the Mini Shai-Hulud package compromise shows how infections spread through dependent libraries used in cloud development workflows.

Cancelling installation after that script starts does not necessarily prevent exposure. The payload can already have collected repository tokens, cloud keys, and infrastructure secrets, leaving defenders with a credential compromise rather than merely an unwanted package.

Other campaigns altered the build environment itself. BufferZoneCorp distributed malicious Ruby gems and Go modules disguised as developer utilities.

These collected secrets, weakened package verification, intercepted commands, and sometimes added an attacker key to preserve remote access.

TeamPCP also compromised trusted scanning tools and libraries. The European Commission cloud breach demonstrates the wider impact of stolen cloud credentials, with attackers moving from a poisoned development tool to unauthorized access and data theft.

Between April 21 and 23, 2026, related attacks struck npm, PyPI, and Docker Hub within 48 hours. In another May campaign, 14 packages impersonating search libraries stole cloud and pipeline secrets.

Attackers then used publishing tokens to infect more packages, turning one compromised developer account into a distribution channel for potentially widespread further credential theft.

Containing Credential Theft And Exposure

Removing a malicious package is only the beginning of recovery. Qualys recommends identifying every credential the affected machine or build system could access, revoking or rotating exposed secrets, and reviewing cloud activity throughout the period of exposure.

Teams should reduce installation risks by approving dependencies, pinning versions through lockfiles, and checking that builds preserve those files. Where workflows permit, disable automatic installation scripts and allow only scripts that have been reviewed and are genuinely required.

Build jobs should carry only the permissions needed for their work. A job that compiles software should not also hold deployment authority. Short lived credentials reduce reliance on permanent keys, while tighter cloud policies can prevent unauthorized administrator creation or disabled logging.

Cloud audit records should be protected against modification and monitored for unusual activity. Investigators should examine unexpected access changes, newly created resources, and suspicious storage access.

These checks help establish what attackers actually did after obtaining legitimate credentials. Finally, restrict access to cloud metadata services when build systems do not need them.

Require AWS IMDSv2, prefer federated identities or managed identities where supported, and keep permissions narrow. Developer security and cloud response must follow the entire attack path.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	webhook.site	Legitimate webhook service identified as an exfiltration channel. Its presence alone does not establish compromise.
IP address	169.254.169.254	Legitimate cloud metadata endpoint targeted for credential harvesting, not an attacker IP. Restrict access where unnecessary.
File path	~/.aws/credentials	AWS credential storage location targeted for harvesting, not a malicious file.
File path	~/.kube/config	Kubernetes configuration location containing access information potentially exposed to malware.
File name	.npmrc	npm configuration file targeted for credentials; also referenced for installation script controls.
File name	.netrc	Authentication file identified as a credential harvesting target.
File path	~/.ssh/authorized_keys	Persistence location where a malicious Go module appended an attacker SSH public key.
Executable name	go	Legitimate command impersonated by malicious wrappers to intercept future build commands.
GitHub account	BufferZoneCorp	Account used to publish malicious Ruby gems and Go modules impersonating developer utilities.
Package name	@ctrl/tinycolor	Legitimate npm package compromised during the original Shai-Hulud campaign; not every version is malicious.
Package scope	@antv	npm ecosystem affected by the May 19 Mini Shai-Hulud wave. The source reports 639 compromised versions across 323 packages.
Package name	echarts-for-react	Downstream package affected by the Mini Shai-Hulud campaign; the source provides no affected version numbers.
Package name	@bitwarden/cli	Legitimate package name associated with a trojaned release in the April campaign.
Environment variable	GITHUB_TOKEN	Repository credential targeted by Mini Shai-Hulud; a harvesting target, not a standalone compromise indicator.
Environment variable	AWS_ACCESS_KEY_ID	AWS credential identifier targeted by the payload.
Environment variable	AWS_SECRET_ACCESS_KEY	AWS secret access key targeted by the payload.
Environment variable	KUBECONFIG	Kubernetes configuration reference targeted for infrastructure access information.
Environment variable	VAULT_TOKEN	HashiCorp Vault authentication token targeted for theft.
Environment variable	GOPROXY	Go module proxy setting redirected by malicious modules to alter dependency retrieval.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC