Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian researchers discovered that the Shai-Hulud infostealer worm now scans 469 credential locations across developer environments, CI/CD tools, cloud setups, and AI configurations, up from 189 previously. This evolution highlights attackers' shift to exploiting existing credentials to maintain persistent supply chain attacks, emphasizing the need to secure credential layers rather than just package registries.