Shai Hulud Worm Moves From CI/CD Pipeline Into AWS Cloud Data
The incident shows CI/CD pipeline identities can become production cloud identities, turning build infrastructure into a direct path to cloud data theft.
Reporting from 1 source: ASCII.jp.
Fortinet's FortiCNAPP helped identify an AWS environment compromised by the Shai Hulud software worm, which targets npm and PyPI packages. Investigators found attackers used a Jenkins EC2 instance role from an external IP, escalated privileges, altered security groups, and extracted data from Amazon Redshift. The campaign, attributed to TeamPCP, collected credentials from build environments.
Fortinet's FortiCNAPP assisted in identifying an AWS environment affected by the Shai Hulud worm in May 2026. Investigators found evidence of ongoing access to a Jenkins runner matching the worm's credential collection patterns. Attackers used the Jenkins EC2 instance role from an external IP, created an IAM user named cloudops-monitor with admin rights, modified security groups, and used the Redshift Data API to run queries.
The worm, named after the sandworm from Dune, embeds malicious packages that run during installation or CI job execution. It collects package registry tokens, GitHub tokens, AWS credentials, Kubernetes secrets, and SSH keys. Recent variants abuse GitHub Actions' trusted OIDC publishing to generate artifacts that appear legitimately certified.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.
Sources
- ASCII.jp CI/CDパイプラインからクラウドへと侵入するソフトウェアワームを特定