# Credential Layer Exposure: Secrets Sprawl and Shai-Hulud npm Supply Chain Credential Harvesting (GitGuardian)

> GitGuardian reports 28.65 million new secrets exposed on public GitHub in 2025 (+34% YoY), with about 28% of secret incidents occurring outside code repositories and developer laptops holding roughly 150 secrets each. The Shai-Hulud npm worm waves (September and November 2025) turned developer and CI environments into credential-harvesting points. GitGuardian's analysis of Shai-Hulud 2.0 found 33,185 unique secrets across 294,842 occurrences, with 3,760 confirmed valid.

- **Published:** 2026-10-22T01:45:28Z
- **Last reviewed:** 2026-10-23T06:00:57.274Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4090
- **ID:** TL-2026-4090
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record documents the credential-layer exposure picture from GitGuardian's 2026 reporting (blog post of 2026-10-21, 'What Is Credential Layer Security?') and the Shai-Hulud supply chain worm it cites as its main case study. The blog is a vendor thought-leadership piece, not a primary DFIR report. It states no CVEs, no threat-actor attribution and no IOCs. The technical detail below comes from primary and secondary reporting on the Shai-Hulud campaigns.

Secrets sprawl statistics (GitGuardian, State of Secrets Sprawl 2026): 28.65 million new secrets were exposed on public GitHub during 2025 (+34% year over year). About 28% of secret incidents occurred outside code repositories. Developer laptops hold about 150 secrets each on average. The blog also cites 24,008 unique secrets in publicly exposed MCP (Model Context Protocol) configuration files, 2,117 of them valid, and an 81% year-over-year rise in AI-service credentials.

Shai-Hulud wave 1 (identified 2025-09-14/15): a self-replicating worm hidden in trojanized npm packages. Over 180 packages were initially reported (including tinycolor), later over 500 per CISA. Malicious code ran bundle.js, which downloaded and ran the legitimate TruffleHog scanner to find GitHub PATs, npm tokens and AWS/GCP/Azure keys. Findings were exfiltrated to a webhook.site endpoint and published to public repositories named 'Shai-Hulud' created through the GitHub /user/repos API. The worm injected the workflow .github/workflows/shai-hulud-workflow.yml and used stolen npm tokens to republish further packages with injected code. CISA published alert guidance on 2025-09-23 recommending dependency review, pinning to versions produced before 2025-09-16, credential rotation, phishing-resistant MFA, and blocking webhook.site.

Shai-Hulud 2.0 'The Second Coming' (prepared from 2025-11-21, launched 2025-11-24): the payload moved to the npm preinstall step using setup_bun.js, which installs the Bun runtime, and bun_environment.js, which holds the core logic. Bun runs outside many detection paths. TruffleHog ran from /home/runner/.truffler-cache/trufflehog with a filesystem sweep of /home/runner. Cloud metadata endpoints and cloud secret managers (AWS, GCP, Azure) were queried with stolen tokens. Instead of a public endpoint, exfiltration used GitHub repositories created with victim credentials. These carried the description 'Sha1-Hulud: The Second Coming' and randomly generated 18-character names. They held cloud.json, environment.json and actionsSecrets.json. Persistence came from registering infected hosts as self-hosted GitHub runners (a discussion-triggered backdoor workflow) and from injecting rogue workflows that serialize repository secrets into CI artifacts, then deleting them. Check Point reports a destructive failsafe that wipes local files when containment is detected. Reported scale is 754 packages (1,700 versions) per GitGuardian, 621 per Check Point, and about 25,000 repositories. GitGuardian's headline analysis found 14,206 secrets across 487 organizations (2,485 still valid), and its broader post-processed dataset has 33,185 unique secrets across 294,842 occurrences, with 3,760 valid (about 11%). GitHub credentials dominated the valid secrets: 581 PATs, 386 OAuth tokens, 104 fine-grained PATs and 101 GitLab tokens. GitGuardian notes the true valid count at leak time was likely higher because many credentials were rotated before validation.

Note on the PyPI claim: the hunt summary and blog tie Shai-Hulud to npm/PyPI. The sourced Shai-Hulud 2.0 figures (754 packages, 20,649 repositories) are npm-based. GitGuardian's separate PyPI research (3,938 unique secrets, 768 valid) is a distinct, earlier study of secrets leaked in PyPI packages and not part of the Shai-Hulud worm.

Defensive takeaway: treat developer endpoints, CI runners, AI-tool/MCP configuration and package install hooks as one credential layer. Prefer short-lived, scoped credentials, disable install scripts where possible, pin dependencies, and monitor GitHub for unexpected repository creation, self-hosted runner registration and new workflows. Severity and status are analyst-assigned, not source-stated.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1078.004 Cloud Accounts
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1119 Automated Collection
- T1020 Automated Exfiltration
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1566.002 Phishing
- T1059.004 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1552.004 Unsecured Credentials
- T1555.006 Credentials from Password Stores
- T1105 Ingress Tool Transfer

## Sources

- [What Is Credential Layer Security? The Layer Every Other Control Trusts (GitGuardian)](https://blog.gitguardian.com/credential-layer-security/)
- [Widespread Supply Chain Compromise Impacting npm Ecosystem (CISA)](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem)
- [Inside the Shai-Hulud NPM Supply Chain Attack (Blackpoint Cyber)](https://blackpointcyber.com/blog/inside-the-shai-hulud-npm-supply-chain-attack/)
- [Shai-Hulud 2.0: Inside The Second Coming, the Most Aggressive NPM Supply Chain Attack of 2025 (Check Point)](https://blog.checkpoint.com/research/shai-hulud-2-0-inside-the-second-coming-the-most-aggressive-npm-supply-chain-attack-of-2025/)
- [Shai Hulud 2.0: The NPM Supply Chain Attack Returns as an Aggressive Self-Propagating Worm (Upwind)](https://www.upwind.io/?p=14565)
- [Shai-Hulud 2.0: Over 14,000 Secrets Exposed (GitGuardian via Security Boulevard)](https://securityboulevard.com/2025/11/shai-hulud-2-0-over-14000-secrets-exposed/)
- [Uncovering Thousands of Unique Secrets in PyPI Packages (GitGuardian)](https://blog.gitguardian.com/uncovering-thousands-of-unique-secrets-in-pypi-packages/)
- [CISA urges orgs to review software after 'Shai-Hulud' supply chain compromise (The Record)](https://therecord.media/cisa-urges-software-reviews-malicious-packages)
- [Shai-Hulud Worm Prowls npm to Steal Hundreds of Secrets (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/supply-chain-worm-hundreds-npm/)
- [Shai-Hulud 2.0 Deep Dive and Actionable Steps You Should Take (Cycode)](https://cycode.com/blog/shai-hulud-2-0-deep-dive-and-actionable-steps-you-should-take/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4090