Shai-Hulud Worm Steals Developer Secrets Across npm, GitHub, AWS, and Kubernetes

Shai-Hulud is a self-propagating, credential-stealing npm worm publicly released by threat actor TeamPCP that targets GitHub Actions, CI/CD pipelines, and developer environments to harvest GitHub, npm, AWS and Kubernetes credentials, exfiltrate them to a C2 (git-tanstack.com), and propagate via compromised GitHub accounts and malicious npm package publishes; the report provides technical details, targeted files, TTPs, and IOCs and warns of rapid code forking and expanded attack surface after the public release.