Supply Chain Attacks Exploit Software Updates to Steal Developer and Cloud Credentials
A new wave of supply chain attacks leverages compromised software updates to inject malware, aiming to steal developer and cloud credentials, as seen in incidents like S1ngularity and Shai-Hulud.
Cybercriminals are increasingly weaponizing trusted software updates as a primary vector for stealing sensitive developer and cloud credentials. Recent supply chain incidents highlight how attackers can compromise a single package, build action, or publishing token to inject malicious code into routine development workflows, bypassing user and security tool trust.
The report from ReversingLabs details how campaigns such as S1ngularity, Shai-Hulud, and TeamPCP demonstrate a rapid escalation of compromise, spreading from a single supplier to numerous downstream organizations. This chain reaction often begins with the theft of credentials for platforms like GitHub and npm, or access to automated release pipelines. Once control is established, attackers can distribute malware disguised as legitimate updates, leading to the exposure of source code, cloud resources, and other critical assets.
The S1ngularity incident serves as a prime example of this tactic. Attackers gained access to Nx packages by exploiting a crafted pull request to obtain a publishing token. They then modified a CI script to trigger a malicious publishing workflow. The resulting infected packages executed post-install hooks on developer machines, specifically designed to search for and exfiltrate valuable data, including tokens, credentials, and SSH keys. In a novel twist, the malware also prompted local AI tools to assist in discovering credential locations, turning a developer's own assistant into an accomplice.
This attack vector is particularly insidious because it exploits the inherent trust placed in software updates. The stolen GitHub credentials found on compromised hosts were even used by attackers to create public repositories, providing a direct channel for exfiltrating the stolen material. The report notes that the prompts used by the malware sought leads to GitHub and npm tokens, cloud credentials, and SSH keys, indicating a sophisticated approach beyond simple password stealing.
Shai-Hulud expanded upon this model by introducing a self-propagating worm. This worm actively searched compromised systems for npm publishing credentials. It then used these credentials to identify packages a victim could publish, subsequently inserting malicious code into further releases. This allowed the malware to spread autonomously across different targets without relying on a unique software flaw at each stage.
Later activities attributed to or associated with the TeamPCP group demonstrated the reuse of previously compromised access. In the Trivy incident, a privileged token extracted in February 2026 was not fully rotated, leaving a pathway for attackers to publish a malicious update on March 19 through an automated system. This involved altering version tags used by CI/CD workflows, a technique previously observed in other poisoning attacks.
The consequences of these attacks extend far beyond individual developer machines. Stolen credentials can grant attackers unfettered access to sensitive code repositories, cloud infrastructure, and deployment pipelines. The report emphasizes the risk posed by long-lived publishing tokens, recommending the adoption of short-lived, per-run credentials and strict permission controls. Organizations are urged to treat poisoned updates as a potential full credential compromise, rotate exposed tokens promptly, and diligently monitor publishing activities for any unauthorized changes.
Recommendations for organizations include replacing long-lived publishing secrets with short-lived credentials, tightly limiting token permissions, pinning CI/CD dependencies to reviewed commits, and maintaining vigilant monitoring of publishing and repository activity for unexpected modifications. Teams that may have run an affected release should prioritize rotating exposed tokens and scrutinizing their environments for unauthorized repositories, workflows, and package publications to mitigate further damage.