Supply chain worms have been scanning developer machines for cloud keys and SSH material for years. The August 2026 Shai-Hulud variant did something narrower and more telling: it went looking for the configuration files of AI coding tools by name, and for the MCP server definitions inside them. The credential list grew from 189 filesystem locations to 469, and the new entries are the files your agents keep their provider keys in.
TL;DR
- Singapore’s Cyber Security Agency advisory AD-2026-009 reports over 1,300 compromised package versions, representing a combined two billion monthly downloads.
- Entry was malicious versions of widely used caching libraries, starting with [email protected] on 4 August 2026. Over 800 downstream packages were affected per Cloud Security Alliance Labs.
- The credential scan grew from 189 to 469 filesystem locations. Linux locations went from 89 to 290, Windows from 12 to 50.
- The new entries include the config files of Cursor, OpenAI Codex, Gemini and other AI coding tools, and the MCP server definitions in them.
- It is a worm: harvested maintainer credentials are used to republish, so the list of compromised packages grows on its own.
#What changed in this variant
Shai-Hulud is not new and neither is the technique. A maintainer account falls, malicious versions go up, a postinstall script walks the filesystem looking for anything that smells like a credential, the loot goes out, and the stolen publishing tokens push the next round. The 2025 campaigns established the pattern.
What Cloud Security Alliance Labs documented in this variant is a change in the shopping list. The scanner went from 189 locations to 469. Linux alone went from 89 to 290. And the growth is not generic: it is a set of paths belonging to AI developer tooling, searched for by name.
Two kinds of thing are being taken there. One is the provider API key the tool uses to talk to its model. The other is the MCP server definitions, which describe which tools the agent can call and, often, what it authenticates to them with.
#The access path, step by step
# as published by CSA Singapore and Cloud Security Alliance Labs npm registry # malicious versions of widely used caching libraries → dependency graph# over 800 downstream packages affected → dev and CI machines# 469 credential locations scanned, up from 189 → AI tool configs # provider tokens and MCP server definitions taken → further packages # republished with harvested maintainer credentials
No step in that chain is a vulnerability in anything you run. The install is normal, the file read is normal, and the file being readable is how the tool works.
#Why a dotfile is now worth stealing
An agent provider key is an unusually good target, and it is worth being precise about why.
It is long-lived, because rotating it means reconfiguring every developer machine that uses the tool. It is plaintext on disk, because the tool has to read it at startup without a prompt. It is broadly scoped, because it is usually an organisation key rather than a per-developer one. And its use is unremarkable in logs, because an agent key making many calls from odd places is exactly what an agent key does.
The MCP definitions are the second half. A definition file says which servers the agent may call and how it authenticates to them. Reading it tells an attacker which internal systems are already wired to an agent on that machine, which is reconnaissance you would otherwise have to work for.
#The third campaign in a row to target agent credentials
Taken alone this would be a curiosity. It is the third documented case in thirteen months.
| Campaign | What it did with AI tooling |
|---|---|
| s1ngularity, August 2025 | Invoked Claude Code, Gemini CLI and Amazon Q CLI with their safety flags disabled, and used them as the credential-finding engine |
| Nx Console extension, May 2026 | Harvester read an AI coding agent settings file alongside cloud and registry tokens |
| ChainDrop, August 2026 | Scanned 469 locations by name, including AI tool configs and MCP server definitions |
The direction is one way. In 2025 the agent was a tool the malware borrowed. In 2026 the agent’s credentials are the loot. If your inventory of secrets still stops at cloud keys, CI variables and SSH material, it is one category behind the people writing the scanners.
#What to check this week
- Find out where your AI tools keep their keys. Not in theory, on actual machines. Settings files, environment files, keychain entries, MCP definition files. You cannot scope what you have not located.
- Check whether those keys are per-developer or organisation-wide. An organisation key on fifty laptops is fifty copies of one credential, and rotating it is a project rather than a decision.
- Treat MCP definitions as sensitive. They describe your internal tool surface. A definition file in a repository is a map an attacker does not have to draw.
- Pin and review dependencies in CI. The entry here is an ordinary install of an ordinary caching library. Lockfiles and a delay before adopting new versions are the boring controls that work.
- Decide what a stolen provider key would cost you, and whether you would notice. If the answer to the second is no, that is the finding, not the worm.
On Elmoz
#FAQ
What is the ChainDrop Shai-Hulud variant?
A self-propagating npm worm that compromised widely used caching libraries starting 4 August 2026 with keyv 6.0.0. Singapore’s Cyber Security Agency advisory AD-2026-009 reports over 1,300 compromised package versions representing around two billion monthly downloads. Cloud Security Alliance Labs documented its credential scan growing from 189 to 469 filesystem locations.
Which AI tools were targeted?
Per the Cloud Security Alliance Labs research note, the expanded scan list named the configuration files of Cursor, OpenClaw, OpenAI Codex, OpenCode, Gemini and Hermes, and collected provider API keys and MCP server definitions alongside cloud credentials, GitHub tokens, SSH keys and Kubernetes configs.
Why are agent provider keys attractive to attackers?
They tend to be long-lived because rotating them means reconfiguring every machine, plaintext on disk because the tool reads them at startup, broadly scoped because they are usually organisation keys, and hard to spot in use because heavy automated traffic is normal for them.
What is the practical defence?
Short-lived, per-project credentials instead of a long-lived key in a dotfile, so the file loses its value before it is found. Beyond that: knowing where the keys actually are, treating MCP definitions as sensitive inventory, and pinning dependencies in CI.
A secret inventory that stops at cloud keys is one category behind the scanners. Elmoz discovers AI agents and the machine identities behind them, including the keys and MCP definitions sitting in developer configuration, and shows what each one reaches.