From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

**Executive summary:** The Fortinet report details the "Shai Hulud" supply‑chain worm (TeamPCP) that injected malicious npm/PyPI packages to run inside CI/CD runners, harvest build and cloud credentials, and leverage those credentials to access AWS (Jenkins instance role abuse), create an admin IAM user (cloudops-monitor), escalate privileges, manipulate RDS/Redshift security groups, enumerate Secrets Manager, execute Redshift Data API queries for large-scale collection, and stage exfiltration to S3 and SES; FortiCNAPP detections, representative IOCs (185.204.1.225, 89.22.231.63, cloudops-monitor, exfil* session names, exfil-s3-* policies), and defensive recommendations are included.