A sophisticated supply chain attack, dubbed Shai Hulud, has been observed leveraging poisoned software dependencies to infiltrate CI/CD pipelines and subsequently gain access to sensitive cloud data, including information stored in Amazon Redshift. The campaign, attributed to a group known as TeamPCP, has been active since late 2025, targeting popular package repositories like npm and PyPI.
The Shai Hulud worm operates by injecting malicious code into software packages. This malicious code executes during the installation process or within continuous integration (CI) jobs. The primary objective of this execution is to harvest credentials from the build environment. These harvested credentials can include package registry tokens, GitHub access tokens, AWS credentials, Kubernetes secrets, and SSH keys.
Once these credentials are stolen, they are used to facilitate the autonomous republication of additional poisoned packages, thereby expanding the attack's reach. Recent variants of the campaign have also exploited trusted OpenID Connect (OIDC) publishing mechanisms within GitHub Actions. This allows attackers to generate software artifacts that appear legitimately signed, even when the build runner itself has been compromised.
Organizations utilizing modern CI/CD practices are particularly vulnerable, as the compromise of a build dependency can serve as a direct pathway into production cloud environments. In May 2026, security tools identified AWS environments affected by this worm. Investigations at the time uncovered evidence of persistent access to a Jenkins runner, consistent with Shai Hulud's credential-harvesting tactics.
The attackers reportedly exploited the Jenkins instance role over the internet, escalating their privileges to achieve full cloud administrative control. They then proceeded to alter database network configurations and exfiltrate data from Amazon Redshift. Additional malicious activities included staging data in object storage and interacting with email services.
A critical lesson for organizations is the direct correlation between pipeline identities and production identities. The attack timeline suggests a supply chain compromise in early May 2026, followed by suspected persistence on build infrastructure through mid-May. This was then followed by cloud intrusion and data exfiltration in mid-May, involving the external use of the Jenkins instance role, privilege escalation, and targeting of Redshift.
The initial cloud access was gained by retrieving instance credentials from the compromised EC2 instance's metadata service. These credentials were then used from external IP addresses to invoke the Jenkins role. Subsequently, an attacker-created IAM user named "cloudops-monitor" was granted administrator privileges and access keys, enabling further privilege escalation.
The attackers manipulated cloud infrastructure by creating new security groups, staging EC2 instances, and modifying database cluster configurations to attach these groups to services like Aurora and Redshift. They also enumerated secrets within AWS Secrets Manager and accessed targeted warehouse secrets, executing queries against Redshift. Data exfiltration was achieved through policies designed for S3 uploads and by using assumed roles with session names indicating exfiltration. Further staging activities were observed involving Amazon Simple Email Service (SES) for identity verification.
Forensic analysis of the Jenkins host revealed access to the instance metadata service, consistent with credential theft. Network telemetry from the build environment also showed an unusual outbound connection on port 8080 to an IP address that was later identified as the source of the "cloudops-monitor" identity and subsequent privileged escalation activities. This correlation strongly links host-level activity to the attacker's infrastructure.
