Shai-Hulud, a self-replicating npm worm first documented in September 2025, escalated sharply in September 2026. According to Mandiant’s AI Risk and Resilience Report, an attacker hijacked an active AI coding assistant session and used it to deploy poisoned packages across 100 internal repositories.
The threat isn’t the worm’s routine mechanics (stealing npm tokens and GitHub OAuth credentials); it’s the delivery vector. One hijacked session compromised 100 repos, suggesting the AI had either direct access to production systems or enough authority to influence deployments across them.
By February 2026, attackers had already begun weaponizing MCP servers as credential harvesters, explicitly targeting AI tooling. This September incident confirms the strategy works. The real risk: hijacked AI sessions can orchestrate code deployments.
Sources: CSA Research Note: Shai-Hulud npm Worm Targeting AI Developer Supply Chain • Mandiant AI Risk and Resilience Report 2026
Coverage: Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories • Shai-Hulud Worm Steals npm, GitHub, AWS, and Kubernetes Secrets From Developers
Related on this blog: [AUTO] MCP’s Secret Problem Isn’t the Bugs • [AUTO] Marimo notebooks execute code just by opening them • [AUTO] Fragmented Instructions Bypass Agent Safeguards