Shai-Hulud’s New Frontier: How Supply-Chain Worms Hook into AI Agents and IDEs

On July 8, npm significantly reduced one of the ecosystem’s largest attack surfaces by disabling lifecycle scripts by default. Less than a month later, the latest Shai-Hulud campaign demonstrated why that change alone wasn’t enough. Rather than relying solely on package installation, the malware shifted execution into the developer’s own tooling, abusing IDE and AI agent configuration files so malicious code runs when a repository is opened or an AI coding session begins.

The result is a supply-chain worm that no longer depends entirely on npm install~. Instead, it turns the developer environment—including AI agents and IDEs—into its execution platform.

The latest Shai-Hulud campaign, referred to by researchers as “Here We Go Again,” affected more than 800 npm packages representing roughly 2 billion monthly package downloads. While earlier stages of the campaign relied heavily on npm lifecycle scripts, this wave demonstrates a significant evolution: the malware now targets local developer environments by hooking directly into AI agents and IDEs.

By abusing tools developers use every day, such as VS Code and Claude Code, the worm ensures its malicious payload can execute even when package installation is no longer the primary execution path.

Shai-Hulud’s hook-based execution flow from IDEs and AI agents

‍

Repository files used by Shai-Hulud to establish persistence

‍

The worm now executes through IDE and AI-agent configuration

Instead of depending solely on package installation, the malware persists by modifying repository configuration files that developers routinely trust.

The worm automatically commits several files across reachable GitHub branches, creating a self-reinforcing execution chain.

• VS Code: The malware creates or modifies .vscode/tasks.json, defining an “Environment Setup” task that automatically runs node .claude/setup.mjs when an infected repository is opened in VS Code.
• Claude Code: It also modifies .claude/settings.json, registering a SessionStart hook that executes node .vscode/setup.mjs whenever a Claude Code session begins inside that repository.

These hooks reinforce each other. Whether a developer opens the project in an IDE or starts an AI coding session, the malware’s bootstrap process executes automatically.

Once executed, the worm steals credentials and spreads

After execution, the malware launches its primary payload (math_init.js) using a bundled Bun runtime before entering a recursive propagation cycle.

Its objectives are straightforward: steal credentials, compromise automation, and publish more infected packages.

1. Credential theft: The collector searches hundreds of locations across Windows, macOS, and Linux, targeting cloud credentials, Kubernetes configurations, SSH keys, GitHub tokens, npm credentials, and API keys for services including OpenAI, Anthropic, and Google Gemini.
2. GitHub Actions abuse: If a stolen GitHub token includes workflow permissions, the malware injects a malicious GitHub Actions workflow named “Run Copilot.” The workflow serializes the repository’s secrets using ${{ toJSON(secrets) }} and uploads them as a seemingly legitimate build artifact for later retrieval.
3. Registry propagation: If writable npm credentials are discovered, the malware automatically increments package versions and republishes compromised packages, allowing the campaign to continue spreading through the npm ecosystem.

The malware doesn’t just execute through AI tooling—it also targets it. Its credential collector enumerates hundreds of locations, including AI-specific directories such as ~/.claude/, ~/.codex/, and ~/.cursor/, alongside traditional cloud and developer credentials. AI agents have become both an execution platform and a valuable source of secrets.

The campaign also anticipates incident response

Shai-Hulud doesn’t simply steal credentials—it also attempts to complicate recovery.

The malware contains a “dead man’s switch” mechanism intended to react when stolen credentials are revoked. Researchers observed logic that wipes parts of the malware’s local state after token revocation, along with dormant functionality for macOS and Linux that periodically checks stolen credentials and can trigger additional handlers if those credentials become invalid.

The campaign also highlights an important limitation of software provenance. Earlier stages abused npm’s Trusted Publishing (OIDC) pipeline, allowing malicious packages to be published with valid provenance. Provenance can verify that a trusted workflow built and published a package, but it cannot guarantee that the source code entering that workflow was itself authorized or uncompromised.

Defending against hook-based supply-chain attacks

Because this campaign extends beyond node_modules into IDEs, AI agents, and repository configuration, traditional cleanup is no longer sufficient.

Organizations should adapt their defenses accordingly.

• Audit IDE and AI-agent hooks. Review all branches for unexpected changes to files such as .vscode/tasks.json, .claude/settings.json, .vscode/setup.mjs, and related configuration files.
• Updating npm helps—but doesn’t stop this attack. npm v12 disables lifecycle scripts by default, reducing one initial infection path. However, repositories that already contain malicious IDE or AI-agent hooks can still execute code when opened.
• Rebuild compromised environments. Developers’ workstations, build machines, and CI runners should be rebuilt from trusted images instead of simply removing malicious files.
• Rotate every exposed credential. Assume that cloud credentials, GitHub tokens, SSH keys, npm tokens, and AI service credentials have been compromised and rotate them immediately.
• Pin dependency versions. Avoid version ranges such as ^ or latest, validate lockfiles, and continuously audit transitive dependencies to reduce exposure to poisoned package updates.
• Treat developer configuration as production code. Protect directories such as .claude/, .vscode/, and .github/workflows/~ with CODEOWNERS and require manual review for every change. Configuration-only pull requests deserve the same scrutiny as application code.
• Scan every branch. This campaign deliberately propagates to every reachable branch, not just main~. Detection strategies should do the same.
• Gain visibility into AI tooling. Maintain an inventory of AI agents, MCP servers, and developer tools across your organization. Without visibility into these environments, malicious configuration changes can persist unnoticed.

The software supply chain now includes AI tooling

Shai-Hulud demonstrates that modern supply-chain attacks no longer stop at package registries. IDEs, AI agents, repository configuration, and developer workstations have become part of both the software supply chain and the attack surface.

As AI-assisted development becomes a standard part of software engineering, securing dependencies alone is no longer enough. Organizations must also secure the tools, configurations, and local environments where developers—and increasingly AI agents—write and execute code.