A Mini Shai-Hulud infostealer worm now scans 469 hardcoded credential locations on compromised developer machines, up from 189 in the family's earlier open-source build, GitGuardian researchers found after analyzing the August 2026 npm wave. The expanded filesystem collector reaches developer environments, CI/CD tooling, cloud configuration files, and AI coding-tool settings, and stolen package-publishing tokens remain a direct path into trusted registries.
Continue reading
The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in✓ Signed in — this article isn’t included in your current plan.
Unlocking the full article...
Contact us
Questions, corrections, or ideas? Send us a message here. We aim to reply by email within 24 hours.
Thank you. Your message has been sent. We aim to reply by email within 24 hours.Please enter your email address and a message.We could not send your message. Please try again in a little while.