Shai-Hulud via a hijacked AI coding-assistant session: Mandiant's case of a poisoned recommendation that spread a worm

Executive Summary

In a case study in its September 2026 report, Mandiant describes an intrusion at an unnamed software-as-a-service provider that began, unusually, inside a developer's live AI coding-assistant session and ended with the self-spreading Shai-Hulud worm across roughly 100 internal code repositories.¹ The sequence Mandiant documents is the notable part: the AI coding assistant recommended a piece of software that the attacker had poisoned, the developer accepted the recommendation, and from there the attacker used the developer's active session to install an infostealer through a poisoned PyPI package and to steal GitHub OAuth tokens.¹ With those tokens, the attacker deployed the Shai-Hulud worm across about 100 internal repositories, stealing repository secrets and the source code for the company's products.¹

The intrusion then compounded itself through the company's own supply chain. The attacker poisoned a package published in the company's official namespace; a second employee pulled the compromised version, causing a second infection inside the same organization.¹ What began as one developer accepting one AI-suggested dependency became a worm loose in the internal codebase and a poisoned first-party package infecting colleagues.

Two things are worth stating plainly because they bound what can honestly be claimed. First, Mandiant's public case study does not say when the intrusion happened, and — more importantly — does not say how the attacker took over the active coding-assistant session in the first place.¹ The headline "attacker hijacked an AI coding assistant" is Mandiant's own framing, but the mechanism of that hijack is undisclosed; the documented AI role is narrower and more specific: the assistant surfaced a poisoned dependency that a human then accepted. Second, this incident sits amid a wave of Shai-Hulud-family activity — in August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, and a later-analyzed variant scanned 469 locations for credentials across developer systems, CI/CD tooling, cloud configuration and AI tool files — but Mandiant's reporting, as relayed by The Hacker News, states that those were separate campaigns and that the available evidence does not link them to this intrusion.¹²

The reason this case matters beyond one anonymized victim is the vector it puts on record. Mandiant has been tracking a shift, described in its March 2026 report, from attackers using generative AI mainly to speed up their work to embedding large language models in malware and live attacks.¹ An AI coding assistant that recommends dependencies is, functionally, a new and trusted software-supply-chain broker sitting inside the developer's workflow — and this case is a concrete instance of that trust being turned into initial access. Mandiant's defensive guidance follows directly: verify AI-recommended dependencies against cryptographic checksums and approved allowlists, keep raw API keys and long-lived OAuth tokens out of the direct reach of extensions, and route dependency traffic through controlled internal repositories.¹

Disclosure: This paper concerns AI coding assistants generally, and the related activity it references includes a worm that planted hooks for Anthropic's Claude Code; the paper was researched and drafted by Claude, an AI assistant made by Anthropic. ThreatPaper has no financial or editorial relationship with Anthropic, Mandiant/Google, or any party named here; this is reported using the same evidentiary standard applied to any other party.

Verification of Claims

1. Claim: An attacker spread the Shai-Hulud worm across ~100 of a SaaS provider's internal repositories after an AI coding assistant recommended poisoned software. → Verified (per Mandiant) → Documented in Mandiant's September 2026 case study: the assistant recommended attacker-poisoned software, the recommendation was accepted, an infostealer was installed via a poisoned PyPI package, GitHub OAuth tokens were stolen, and the worm spread across about 100 internal repositories, stealing secrets and source code.¹

2. Claim: The attacker "hijacked" / compromised the AI coding assistant. → Assessed / mechanism undisclosed → Mandiant confirms the attacker took over an active coding-assistant session, but its public case study does not say how the session was taken over.¹ The documented AI role is recommending a poisoned dependency that a developer accepted — a human-in-the-loop acceptance — not a demonstrated compromise of the AI model or assistant software itself.

3. Claim: This intrusion is part of the wider Shai-Hulud npm-worm campaign. → Unverified → The Hacker News, reporting Mandiant's finding, states that the August Keyv-linked npm worm and the 469-location credential-scanning variant were "separate campaigns, and the available evidence does not link them to the unnamed Mandiant intrusion."¹

4. Claim: A second infection occurred inside the same company. → Verified (per Mandiant) → The attacker poisoned a package in the company's official namespace, and another employee pulled the compromised version, causing a second infection.¹

Timeline

Attack Anatomy

Mandiant has not disclosed the intrusion date or the method of the initial session takeover, so the chain below starts from the first documented action.

Initial access — a poisoned AI-recommended dependency, accepted

Inside a developer's active AI coding-assistant session, the assistant recommended software the attacker had poisoned, and the developer accepted the recommendation (T1195.001, T1204.002).¹ How the attacker was positioned to have that poisoned dependency surfaced, and how the active session was taken over, are not stated in the public case study.¹

Execution and token theft

Using the developer's active session, the attacker installed an infostealer through a poisoned PyPI package and stole GitHub OAuth tokens (T1528).¹

Worm propagation across the codebase

With the stolen OAuth tokens, the attacker deployed the self-spreading Shai-Hulud worm across roughly 100 internal repositories (T1550.001, T1080), stealing repository secrets and the source code for the company's products (T1552.001, T1213.003).¹

Second-order infection via the official namespace

The attacker poisoned a package in the company's own official namespace; a second employee pulled the compromised version, producing a second infection within the organization (T1080).¹

Threat Actor Profile

• Attacker: Unattributed. Mandiant does not name an actor or link the intrusion to a known group.¹
• Attribution confidence: Not applicable.
• Assessment: The objective was clearly access and theft of intellectual property — repository secrets and product source code — achieved by turning a trusted, in-workflow AI assistant into a delivery path for a poisoned dependency and then leveraging developer OAuth tokens for worm propagation. The tradecraft reflects Mandiant's broader observation that attackers are increasingly building AI and developer tooling into live operations rather than merely using AI to draft their work.¹
• Relationship to other Shai-Hulud activity: The Shai-Hulud worm and name appear across multiple, distinct operations in this period (the npm-registry campaigns of August, the 469-location credential scanner). Mandiant's intrusion used the Shai-Hulud worm but is not, on the available evidence, linked to those separate campaigns.¹²

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

# Mandiant's public case study is an anonymized incident write-up; it does not
# publish the victim, the specific poisoned package names, hashes, or attacker
# infrastructure. The value here is the vector and the controls, not IOCs.
victim: "unnamed SaaS provider"
initial_vector: "AI coding assistant recommended attacker-poisoned software; developer accepted"
session_takeover_method: "not disclosed by Mandiant"
intrusion_date: "not disclosed by Mandiant"
payloads:
  - "infostealer delivered via a poisoned PyPI package"
  - "Shai-Hulud self-spreading worm across ~100 internal repositories"
stolen:
  - "GitHub OAuth tokens"
  - "repository secrets"
  - "source code for the company's products"
second_infection: "attacker poisoned a package in the company's official namespace; another employee pulled it"
related_but_separate_campaigns:
  - "August: Keyv-linked npm worm poisoned hundreds of packages; planted hooks for Claude Code and VS Code"
  - "Shai-Hulud variant scanning 469 locations for credentials (dev systems, CI/CD, cloud config, AI tool files)"
  - "not linked to this intrusion per Mandiant"
network_iocs: none disclosed
file_hashes: none disclosed

Legal and Regulatory Response

None reported. This is a vendor incident case study (Mandiant) describing an anonymized victim; no regulator, law-enforcement action, or named-company disclosure is attached to it.¹ The response guidance is Mandiant's own set of controls for AI-assisted development: verify AI-recommended dependencies against cryptographic checksums and approved allowlists, keep raw API keys and long-lived OAuth tokens out of the direct reach of extensions, and route dependency traffic through controlled internal repositories.¹

Impact Assessment

• Confirmed (per Mandiant): Shai-Hulud worm spread across ~100 internal repositories; repository secrets and product source code stolen; a second internal infection caused by a poisoned official-namespace package.¹
• Confirmed: Initial access originated from a poisoned dependency recommended inside a live AI coding-assistant session and accepted by a developer, followed by infostealer install and GitHub OAuth token theft.¹
• Unknown: The victim's identity; the intrusion date; how the attacker took over the active coding-assistant session; the specific poisoned packages; and whether any customer data (as opposed to the company's own source and secrets) was affected.¹
• Not established: Any link between this intrusion and the separate Shai-Hulud npm-registry campaigns of the same period.¹

Lessons and Defensive Recommendations

For engineering and AppSec teams:

• Treat an AI coding assistant that recommends dependencies as an untrusted software-supply-chain broker inside your build. Apply the same controls you would to any external package source: verify AI-recommended dependencies against cryptographic checksums and an approved allowlist before install, and route all dependency traffic through a controlled internal registry rather than pulling directly from public registries on a developer's word — or an assistant's.¹
• Keep raw, long-lived credentials out of the blast radius of developer tooling. This intrusion escalated because a live session and reachable GitHub OAuth tokens let one accepted recommendation become worm propagation across ~100 repos. Prefer short-lived, narrowly scoped tokens; keep API keys and OAuth tokens out of direct reach of IDE extensions and assistant sessions; and isolate secrets from the environment where AI tooling runs.¹

For platform and detection teams:

• The second infection came from the company's own official namespace being poisoned. Monitor and gate publishes to first-party package namespaces as tightly as you monitor inbound dependencies — a trusted internal package is exactly the vehicle a worm uses to reach colleagues who would never pull an obviously external malicious package.
• Self-spreading behavior across repositories (mass use of OAuth tokens to push to many repos in a short window) is a detectable pattern independent of any specific malware signature. Alert on anomalous fan-out of repository writes or package publishes from a single developer identity.

For readers tracking "Shai-Hulud":

• The name now covers several distinct operations. This Mandiant case, the August npm-registry worm, and the 469-location credential scanner are being reported together because they share the Shai-Hulud family, but Mandiant states its intrusion is not linked to those campaigns on the available evidence. Do not treat "Shai-Hulud" coverage as describing a single event or actor.

Sources