News · Sep 3, 2026
The Shai-Hulud worm now hunts 469 credential locations, up from 189
GitGuardian found the latest Shai-Hulud variant scanning 469 paths for secrets across developer machines, CI/CD, cloud config, and AI tool settings. The npm worm spreads using the credentials it finds, with no human operator in the loop.