Securify

A New Breed of Supply-Chain Attack

A threat actor hijacked a developer’s AI coding assistant, tricked it into recommending a poisoned software package, and then rode that foothold to deploy a self-propagating worm across roughly 100 internal code repositories at an unnamed SaaS company. The incident, documented in Mandiant’s September 2026 AI Risk and Resilience Report, is being called the first publicly confirmed case of an AI-assisted development tool being weaponized in a live enterprise breach — and it raises urgent questions about the trust developers place in their AI pair-programming partners.

The malware at the center of the attack is known as Shai-Hulud, a supply-chain worm whose broader ecosystem has been tracked by researchers at Google Mandiant, Socket, and the Cloud Security Alliance since earlier this year. What makes the Mandiant case study stand out is the attack chain: it did not start with a phishing email or a misconfigured server. It started with a compromised AI session.

How the Attack Unfolded

According to Mandiant’s report, the attack progressed through five distinct stages. First, the threat actor gained access to an active AI coding-assistant session on a developer’s workstation at the target SaaS provider. The exact method of the initial session takeover was not disclosed publicly, but once inside, the attacker had something far more valuable than a shell — they had a trusted interpreter.

In the second stage, the compromised assistant recommended the developer install an external software package. That package had been poisoned in advance by the attacker and uploaded to PyPI, the Python Package Index. The developer, trusting the AI’s recommendation, accepted and installed it. At that point, the AI assistant had functioned as what Mandiant called a “trojan horse,” facilitating malware delivery through a channel the developer had no reason to question.

Stage three saw the poisoned package deploy an infostealer that harvested GitHub OAuth tokens from the compromised development environment. With those tokens in hand, the attacker had authenticated, programmatic access to internal repositories — no additional credential theft required.

In stage four, the attacker deployed the Shai-Hulud worm itself. The worm propagated autonomously across approximately 100 internal code repositories, automating the theft of repository secrets and exfiltrating proprietary source code for the company’s products.

The fifth and final stage extended the damage further. The threat actor poisoned a package within the organization’s own official namespace, creating a secondary downstream infection vector. When another employee pulled the compromised internal package, the attack surface expanded beyond the original 100 repositories.

The Broader Shai-Hulud Ecosystem

The Mandiant incident is not an isolated case. Parallel research by Socket has revealed a broader campaign called SANDWORM_MODE — an evolved variant of the Shai-Hulud worm distributed across 19 malicious npm packages under two publisher aliases. This variant adds AI toolchain poisoning and enhanced CI/CD exploitation capabilities that paint a troubling picture of where supply-chain attacks are headed.

The SANDWORM_MODE variant uses typosquatting to impersonate popular packages. Names like claud-code, cloude-code, and cloude target developers using AI coding tools, while packages like suport-color mimic widely used utilities such as supports-color. Once installed, these packages maintain expected library behavior on the surface while executing covert payloads.

What makes the npm variant especially dangerous is its MCP (Model Context Protocol) server injection capability. The worm generates innocuous-sounding names like “dev-utils” and deploys malicious MCP servers into the configuration files of popular AI coding assistants — including Claude Code, Cursor, VS Code Continue, and Windsurf. Each injected server contains embedded prompt-injection instructions that direct the AI to silently read SSH keys, AWS credentials, npm tokens, and other secrets, then exfiltrate them without alerting the user.

The worm propagates through three independent vectors: npm token theft and republishing of compromised packages, GitHub API abuse to inject dependencies and create pull requests with innocent titles like “Routine dependency version update,” and SSH-based repository cloning as a fallback. It also installs persistent Git hooks that re-inject malware into any repository the developer touches in the future.

Why This Changes the Threat Landscape

AI coding assistants have become embedded in development workflows at a remarkable pace. Developers routinely accept package recommendations, code suggestions, and configuration changes from these tools with a level of trust that, until now, has not been seriously tested by adversaries. The Shai-Hulud incident demonstrates that this trust can be weaponized.

“AI tools positioned as trusted advisors can be weaponized if their session is compromised,” the Mandiant report states plainly. The implication is significant: an AI assistant with write access to a codebase and the developer’s credentials is not just a productivity tool — it is an attack surface.

The timing is also notable. Mandiant’s report documents a broader pattern: the February 2026 OpenClaw weaponization incident, the March 2026 UNC6780 (TeamPCP) supply chain compromises, and now this. AI-assisted development tools are becoming a preferred target for sophisticated threat actors because they sit at the intersection of high trust, broad access, and limited security monitoring.

What Defenders Should Do Now

Mandiant recommends a three-layered defense strategy. First, organizations should enforce IDE and CLI verification hooks that validate all AI-recommended third-party dependencies against cryptographic checksums and approved allowlists. No package an AI suggests should be installed without automated verification against a known-good registry.

Second, credential isolation is critical. AI extensions and plugins should never have access to raw API keys, long-lived OAuth tokens, or repository secrets. Just-in-time secrets management — where credentials are issued for a single operation and immediately revoked — significantly reduces the blast radius of a compromised session.

Third, workstation network egress should be restricted to route all dependency traffic through secure, internal repositories rather than allowing direct downloads from public registries. This prevents a compromised AI from pulling payloads from attacker-controlled sources.

For organizations that may already be affected, Socket’s guidance is more immediate: remove any suspicious packages, delete node_modules, treat any environment where they ran as compromised, rotate all npm and GitHub tokens, and audit Git hook configurations and AI assistant config files for unexpected MCP server entries.

The Bottom Line

The Shai-Hulud incident marks a turning point. AI coding assistants are no longer theoretical attack surfaces — they are proven ones. As Mandiant’s report concludes, defending against this class of threat requires a shift from static security policies to continuous runtime monitoring and cryptographic verification of all AI-recommended actions. For development teams that have integrated AI assistants into their daily workflows, the message is clear: trust, but verify — every package, every suggestion, every session.