Shai-Hulud Expands to PyPI, CI/CD Abuse, IDE Hooks and AI Scanner Evasion
Summary
Zscaler describes Shai-Hulud’s spread from npm to PyPI and its use of CI/CD abuse, IDE configuration hooks, credential theft and prompt injection. The worm’s source code became public on May 12, 2026, making its techniques reusable.
Key points
- The campaign expanded beyond npm to PyPI and shifted from maintainer-focused compromise toward CI/CD abuse.
- Reported techniques include scraping OIDC tokens, abusing publishing workflows, .pth persistence, and executing through IDE configuration hooks.
- Prompt injection was added to evade AI-based security scanners.
- The worm’s complete source code was publicly released under an MIT license on May 12, 2026; attribution for activity after that date is less certain.
- Zscaler lists file, hash, and network indicators, including malicious PyPI artifacts and the domain models[.]litellm[.]cloud.
- Zscaler says its protections detect malicious npm package downloads under several listed threat classifications.
Article Details
- Attack Vectors
- Compromise of npm and PyPI packages, including install-time execution.
- Abuse of CI/CD workflows to publish malicious packages and undermine provenance and OIDC-based publishing workflows.
- OIDC token scraping.
- Python .pth files used for persistence.
- IDE configuration files containing startup or folder-open hooks that trigger malicious execution.
- Prompt injection intended to evade AI-based security scanners.
- Use of a GitHub dead-drop C2 polling loop.
- Defensive Notes
- Organizations should assume these techniques may be used beyond the original campaign and harden their defenses accordingly.
- Zscaler reports enhanced detection coverage for malicious npm package downloads under the listed threat classifications.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | models[.]litellm[.]cloud | Miasma exfiltration domain, according to the article. |
| SHA256 | c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c | Hash of the -setup.pth persistence artifact, reported as consistent across Hades PyPI artifacts. |
| SHA256 | dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe | Hash of the malicious _index.js payload from the Hades PyPI wave. |
| SHA256 | e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d | Hash of a variant of the malicious _index.js payload from the Hades PyPI wave. |
| URL | hxxps[:]//api[.]anthropic[.]com/v1/api | Staged C2 camouflage destination in analyzed samples; the article says it was not active. |