Ruff CI Checks Block Shai-Hulud Credential-Stealer Injection in GPT-Pilot Repository
Summary
StepSecurity reports that ruff CI checks blocked two force-push attempts adding a Shai-Hulud credential stealer to Pythagora’s gpt-pilot repository on June 8, 2026. The payload targeted developer credentials and used GitHub-based C2 and persistence hooks.
Key points
- StepSecurity reports that two force-push attempts from a compromised maintainer account added malicious files to the repository; all six CI jobs failed on both attempts.
- The ruff formatter and linter caught formatting and import-order violations in the injected code.
- The payload was a 758KB obfuscated JavaScript credential stealer launched through a Python loader and Bun runtime.
- It targeted AWS, npm, GitHub, Kubernetes, Vault, and SSH credentials, and used GitHub commit searches for command-and-control.
- The malware could exfiltrate credentials through newly created GitHub repositories and plant persistence hooks for Claude Code and VS Code sessions.
- StepSecurity links the payload to Shai-Hulud and TeamPCP/UNC6780, while noting that the public release of related source code makes attribution uncertain.
- The article advises potentially affected users to rotate credentials, audit cloud and package-publishing activity, and check for malware files and persistence hooks.
Article Details
- Attack Vectors
- The attacker used a compromised maintainer GitHub account to force-push a backdated, malicious commit to the repository’s unprotected main branch.
- The injected Python loader ran a JavaScript credential stealer through the Bun runtime when the package’s telemetry module was imported.
- The malware searched GitHub commit messages for a marker string to receive commands, and used GitHub repositories to exfiltrate stolen credentials.
- The malware also used DNS-resolved HTTP endpoints for encrypted data exfiltration and added hooks to Claude Code and VS Code for persistence.
- The article attributes the activity to the Shai-Hulud campaign associated with TeamPCP/UNC6780, but notes that public release of source code makes copycat activity possible.
- Defensive Notes
- Enable branch protection, require pull-request reviews and passing status checks, restrict force pushes to the default branch, and require signed commits.
- Monitor force pushes to default branches and use CI linting and formatting checks; ruff’s checks blocked both attempted malicious pushes in this incident.
- If the repository was pulled during the stated exposure window, inspect for the injected files, downloaded Bun runtime, loader lock file, and Claude Code or VS Code persistence hooks.
- Rotate potentially exposed AWS keys, npm tokens, GitHub tokens, SSH keys, and other secrets; audit cloud access, npm publishing, and GitHub repositories for unauthorized activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
claude@users[.]noreply[.]github[.]com | Commit author identity the malware impersonates when creating GitHub repositories to exfiltrate stolen credentials. | |
| SHA1 | 065ee8ebee7385cb644fd1608587a18edb91f4fb | Git commit ID for the malicious backdated “Revert” commit that added the loader and payload. |
| SHA256 | 51b4dd39a15af1e28e97adc375849d688423ec3d88e8010644395fcdea52a3cc | SHA-256 hash of the malicious _hooks.py loader that downloads and executes the payload. |
| SHA256 | c96f37e1b9cdc9683a300909492ed9f770b620d0037e5b80e23753cba7ca4077 | SHA-256 hash of the malicious _runtime.bin JavaScript credential-stealer payload. |
| URL | hxxps[:]//api[.]github[.]com/search/commits?q=thebeautifulsnadsoftime | Specific GitHub commit-search URL used by the malware to poll for its command-and-control marker. |
MITRE ATT&CK
T1059.007 · JavaScriptThe injected loader downloaded Bun and used it to execute the JavaScript credential-stealer payload.T1071.004 · DNSThe payload used DNS-resolved HTTP endpoints as a fallback channel for encrypted exfiltration.T1102.002 · Bidirectional CommunicationThe malware searched GitHub commits for a marker and extracted commands from matching commit messages.T1195.002 · Compromise Software Supply ChainMalicious files were inserted into the legitimate gpt-pilot repository through a force-pushed commit.T1528 · Steal Application Access TokenThe payload targeted GitHub, npm, and OIDC tokens, among other credentials.T1552.001 · Credentials In FilesThe payload targeted credentials in files including .aws/credentials, .kube/config, and .vault-token.T1552.005 · Cloud Instance Metadata APIThe article says the payload queried EC2/ECS instance metadata endpoints for IAM credentials.T1567.001 · Exfiltration to Code RepositoryThe malware created GitHub repositories and committed stolen credentials as files for exfiltration.
People
Charlie EriksenThe article credits him, of Aikido Security, with disclosing the compromise on X.LeonOstrezPythagora co-founder and repository maintainer whose GitHub account the article says was compromised and used to force-push the malicious commits.Zvonimir SabljicThe malicious backdated commit claimed to be authored by him, but the article says that identity was likely spoofed.
Threat Actors
Malware
Products
AWSrepository was not a simple backdoor. It is a 758KB obfuscated JavaScript credential stealer that targets AWS keys, npm tokens, GitHub secrets, Kubernetes service accounts, HashiCorp Vault tokens, and SSH keys. ItBunDownloads Bun v1.3.13 runtime and executes the JavaScript payload.Claude Codepackages with valid SLSA Build Level 3 attestations via Sigstore. It even plants persistence hooks in Claude Code and VS Code so that future coding sessions re-execute the malware.GitHubOn June 8, 2026, an attacker compromised a co-founder's GitHub account for Pythagora-io/gpt-pilot, a popular open-source AI developer tool with 33,700+ GitHub stars and 3,500+ forks, and force-pushed agpt-pilotOn June 8, 2026, an attacker compromised a co-founder's GitHub account for Pythagora-io/gpt-pilot, a popular open-source AI developer tool with 33,700+ GitHub stars and 3,500+ forks, and force-pushed aHashiCorp Vaultcredential stealer that targets AWS keys, npm tokens, GitHub secrets, Kubernetes service accounts, HashiCorp Vault tokens, and SSH keys. It uses GitHub commit messages as a covert command-and-control channel,Kubernetesis a 758KB obfuscated JavaScript credential stealer that targets AWS keys, npm tokens, GitHub secrets, Kubernetes service accounts, HashiCorp Vault tokens, and SSH keys. It uses GitHub commit messages as a covertnpmwas not a simple backdoor. It is a 758KB obfuscated JavaScript credential stealer that targets AWS keys, npm tokens, GitHub secrets, Kubernetes service accounts, HashiCorp Vault tokens, and SSH keys. It uses GitHubSigstoreas files, and can sign and publish malicious npm packages with valid SLSA Build Level 3 attestations via Sigstore. It even plants persistence hooks in Claude Code and VS Code so that future coding sessions re-executeVS Codevalid SLSA Build Level 3 attestations via Sigstore. It even plants persistence hooks in Claude Code and VS Code so that future coding sessions re-execute the malware.
Tools
harden-runnerForce pushes to default branches are almost always suspicious in production repositories. Tools like StepSecurity Harden-Runner can detect and alert on force pushes as part of a broader CI/CD security posture.ruffcoding workflows. The malware, a variant of the Shai-Hulud worm, was stopped by an unlikely defender: ruff, a Python code formatter. The attacker tried twice to get the malicious code past CI and failed both times