Threat reportSupply ChainTL-2026-4004
Developer credential exposure on dev machines: StepSecurity Dev Machine Guard credential-source inventory (context: TeamPCP stealer, Bitwarden CLI npm hijack, Shai-Hulud)
Developer credential exposure on dev machines (TL-2026-4004), also tracked as Shai-Hulud, is a medium-severity supply-chain compromise, first published 2026-10-21. It is attributed to TeamPCP with low confidence, affects Xorbits (xinference) xinference (PyPI), maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1059.004), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 1TeamPCP
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4004
- Threat ID
- TL-2026-4004
- Also known as
- Shai-Hulud, Sha1-Hulud: The Second Coming, Shai-Hulud: The Third Coming, Checkmarx supply chain campaign
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- TeamPCP
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, devops, ai-ml, cloud
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Developer credential exposure on dev machines
Malware and tooling: Shai-Hulud, Shai-Hulud (Sha1-Hulud) npm worm, TeamPCP credential stealer, Bun
How Developer credential exposure on dev machines works
StepSecurity's Dev Machine Guard (agent v1.16.0+) now inventories 13 credential source types across five categories on developer machines, the same well-known file locations that recent supply-chain stealers target. The cited incidents are the TeamPCP-branded xinference PyPI compromise (April 2026), the Bitwarden CLI npm hijack (@bitwarden/cli@2026.4.0, April 2026) and the second Shai-Hulud npm worm wave (November 2025).
The source article (StepSecurity, 2026-08-25) is a vendor product announcement, not a primary incident report. Dev Machine Guard now reports where developer credentials live and how widely they are spread across a fleet, including how many are stored without encryption or passphrase protection. It covers 13 credential source types in five categories: cloud (AWS credentials, gcloud application default credentials), source control (GitHub tokens, ~/.git-credentials, SSH keys id_rsa/id_ed25519/id_ecdsa), package registries (~/.npmrc, ~/.pypirc), containers (~/.docker/config.json) and infrastructure (Vault tokens, kubeconfig, ~/.netrc). Agent v1.16.0 is the earliest version with the inventory; on macOS, Full Disk Access via MDM is needed to read TCC-protected paths, and the inventory populates after the next device scan following the upgrade.
The article justifies the inventory with three supply-chain incidents in which malicious package code harvested exactly these locations. (1) xinference on PyPI: versions 2.6.0, 2.6.1 and 2.6.2 were published with a two-stage stealer in xinference/__init__.py that runs on import. A base64 wrapper carrying a '# hacked by teampcp' marker launches a detached Python subprocess that collects SSH keys, AWS/GCP/Azure/Docker/Kubernetes credentials, .env files (up to 6 directory levels), CI/CD configs, TLS private keys, .npmrc/.pypirc/.netrc, shell history and cryptocurrency wallets, makes live calls to AWS Secrets Manager and SSM Parameter Store with harvested credentials, packs the output into love.tar.gz and POSTs it unencrypted via curl to whereisitat.lucyatemysuperbox.space with header X-QT-SR: 14. The versions were detected and yanked on 2026-04-22. TeamPCP's own account reportedly disclaimed the xinference compromise as the work of a copycat, so attribution is disputed.
(2) @bitwarden/cli@2026.4.0 on npm was live from 5:57 PM to 7:30 PM ET on 2026-04-22 (about 334 downloads), published through a compromised GitHub Actions workflow in Bitwarden's CI/CD pipeline as part of the wider Checkmarx supply-chain campaign. A new preinstall hook runs bw_setup.js, which downloads the Bun runtime (v1.3.13) and executes the 9.7 MB obfuscated payload bw1.js. The payload steals GitHub/npm tokens, SSH keys, git credentials, shell history, AWS/GCP credentials and AI coding tool configuration (Claude Code ~/.claude.json, Cursor, Kiro, Codex CLI, Aider, MCP configs). It encrypts the data with AES-256-GCM and sends it to audit.checkmarx.cx/v1/telemetry, with GitHub-commit and victim-repository fallback channels. It also weaponizes any GitHub token it finds to enumerate repositories, pull Actions secrets and inject workflows, adds shell RC persistence, and skips Russian-locale systems. Bitwarden shipped 2026.4.1 as a re-release of 2026.3.0.
(3) Shai-Hulud second wave (Sha1-Hulud: The Second Coming, detected around 2025-11-21 to 2025-11-24): npm packages carry a setup_bun.js preinstall dropper and a 10 MB+ obfuscated bun_environment.js payload. The worm steals npm tokens, GitHub tokens and cloud credentials, creates public exfiltration repositories described 'Sha1-Hulud: The Second Coming' and registers a self-hosted runner named SHA1HULUD. Stolen npm tokens are used to republish additional compromised packages (up to 100 per victim), and on authentication failure the payload attempts destructive file wiping (shred on Linux/macOS).
Defender takeaway: the credential files these stealers read are the same ones the inventory enumerates, so reducing unencrypted long-lived secrets on developer machines (passphrase-protected SSH keys, short-lived cloud credentials, avoiding plaintext tokens in .npmrc/.pypirc/.git-credentials), disabling lifecycle scripts in CI (npm ci --ignore-scripts) and pinning dependencies reduces blast radius. Severity MEDIUM and status MONITORING are analyst-assigned, not stated in the source.
MITRE ATT&CK techniques used in TL-2026-4004
Collection
T1005 Data from Local System; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 File Deletion
Execution
T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript
Command and Control
T1071.001 Web Protocols; T1573.001 Symmetric Cryptography
Discovery
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Impact
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.004 Private Keys; T1552.005 Cloud Instance Metadata API
Persistence
T1546.004 Unix Shell Configuration Modification
Exfiltration
Affected products and versions in Developer credential exposure on dev machines
- Xorbits (xinference) — xinference (PyPI)
Vulnerable versions: 2.6.0; 2.6.1; 2.6.2
Fixed in: versions prior to 2.6.0 - Bitwarden — @bitwarden/cli (npm)
Vulnerable versions: 2026.4.0
Fixed in: 2026.4.1; 2026.3.0 - Multiple npm maintainers — npm packages compromised in Shai-Hulud second wave (e.g. Zapier, ENS Domains integrations)
Vulnerable versions: malicious republished versions
Fixed in: clean prior versions
Remediation for Developer credential exposure on dev machines
Patches
- @bitwarden/cli 2026.4.1 (re-release of 2026.3.0)
- xinference releases prior to 2.6.0
Immediate actions
- Pin or downgrade: pip install "xinference<2.6.0"; npm install @bitwarden/cli@2026.3.0 --ignore-scripts (or 2026.4.1)
- Rotate all credentials reachable from affected machines: GitHub PATs, npm tokens, PyPI tokens, SSH keys, AWS/GCP/Azure keys, Kubernetes tokens, Vault tokens, Docker registry auth, API keys
- Hunt for /tmp/love.tar.gz and connections to whereisitat.lucyatemysuperbox.space, audit.checkmarx.cx and 94.154.172.43
- Audit GitHub for unexpected workflows, branches and public repositories described 'Sha1-Hulud: The Second Coming' and for self-hosted runners named SHA1HULUD
- Review AWS CloudTrail for Secrets Manager and SSM Parameter Store reads using potentially exposed keys
Workarounds
- Disable npm lifecycle scripts (--ignore-scripts)
- Block runtime downloads (Bun) from build and developer hosts where not required
- Grant macOS Full Disk Access via MDM so credential inventory can scan TCC-protected paths
Longer-term hardening
- Inventory credential locations across the developer fleet (e.g. Dev Machine Guard v1.16.0+) and remove plaintext, non-expiring secrets
- Protect SSH keys with passphrases or hardware-backed keys; prefer short-lived cloud credentials and OIDC over static tokens
- Run CI installs with npm ci --ignore-scripts and pin exact dependency versions
- Restrict and monitor GitHub Actions workflow changes; limit token scopes
Weaknesses (CWE) in Developer credential exposure on dev machines
Timeline of Developer credential exposure on dev machines
- StepSecurity publishes analysis of the Sha1-Hulud second wave: npm packages with setup_bun.js/bun_environment.js steal tokens and create public exfiltration repositories (over 21,000 within 5 hours of detection)
- TeamPCP compromises the litellm PyPI package (per StepSecurity)
- TeamPCP compromises the telnyx PyPI package (per StepSecurity)
- Malicious @bitwarden/cli@2026.4.0 distributed on npm between 5:57 PM and 7:30 PM ET (~334 downloads) via a compromised GitHub Actions workflow
- Malicious xinference 2.6.0, 2.6.1 and 2.6.2 detected on PyPI with a two-stage credential stealer in __init__.py and yanked
- StepSecurity and other researchers publicly disclose the Bitwarden CLI compromise; Bitwarden releases 2026.4.1 (re-release of 2026.3.0)
- StepSecurity announces Dev Machine Guard agent v1.16.0 credential inventory covering 13 credential source types in five categories
Sources cited for Developer credential exposure on dev machines
- Dev Machine Guard Now Inventories Where Developer Credentials Live (StepSecurity)
- TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package (StepSecurity)
- Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools (StepSecurity)
- Sha1-Hulud: The Second Coming - Zapier, ENS Domains, and Other Prominent npm Packages Compromised (StepSecurity)
- Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign (The Hacker News)
- TeamPCP strikes again: Xinference PyPI package compromised (JFrog)
- Xinference allegedly hacked by TeamPCP, malicious package in PyPI (OX Security)
- Bitwarden CLI Supply Chain Compromise (SafeDep)
- Bitwarden CLI 2026.4.0 infected with malware (Bitwarden Community)
- Shai-Hulud 2.0 Deep Dive and Actionable Steps You Should Take (Cycode)
- SANS ISC Diary 32926 (xinference compromise)
Detection coverage for TL-2026-4004
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4004 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4004
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.