TL;DR

Mandiant investigated an intrusion at a SaaS provider in which a threat actor hijacked an active AI coding assistant session on a developer workstation. The coding assistant recommended installation of an external software package that had been poisoned by the attacker. Once the recommendation was accepted, the attacker used the developer’s active session to install an infostealer through the poisoned PyPI package, steal GitHub OAuth tokens, and deploy the self propagating Shai-Hulud worm across approximately 100 internal code repositories.

The worm automated theft of repository secrets and exfiltration of proprietary source code. The attacker then poisoned a package inside the victim organization’s own namespace, causing a secondary infection when another employee pulled the compromised package version.

Mandiant does not disclose how the attacker initially hijacked the coding-assistant session, so we cannot infer the mechanism yet.

What Happened

Mandiant says the threat actor first compromised a SaaS provider and obtained control over an active AI coding assistant session running on a developer’s workstation. The assistant operated within the developer environment and recommended installation of an attacker poisoned external package. After that recommendation was accepted, the attacker used the active session to install an infostealer through a poisoned PyPI package. The malware harvested GitHub OAuth tokens, which were then used as part of the subsequent compromise.

Mandiant reports that Shai-Hulud propagated across approximately 100 internal repositories. The worm stole repository secrets and programmatically exfiltrated proprietary product source code. The actor later poisoned a package inside the company’s official namespace, and another employee pulling that compromised version caused a secondary infection.

The report does not identify the victim organization, the coding assistant product, the exact poisoned PyPI package, or the method used to take over the original AI session.

Core Attack Pattern

The attack is significant because the AI coding assistant became part of the software supply-chain trust path.

The observed sequence was:

AI coding assistant session hijacked → assistant recommends attacker poisoned dependency → recommendation accepted → poisoned PyPI package installs infostealer → GitHub OAuth tokens stolen → Shai-Hulud propagates across internal repositories → repository secrets and source code stolen → trusted internal package namespace poisoned → secondary downstream infection

The AI assistant did not itself create the malware or autonomously compromise repositories. Its role was narrower but important: it acted as a trusted recommendation channel through which an attacker controlled dependency entered the developer environment.

The later stages were conventional supply chain compromise: credential theft, repository access, worm propagation, secret theft, source-code exfiltration, and poisoning of an internal package namespace.

The central control opportunity therefore appears before dependency installation: an AI recommendation should not bypass normal software supply chain validation.

‍

The Attack Progression Across The AI Kill Chain

1. Reconnaissance - Bypassed entirely. Not disclosed. The report does not describe how the attacker selected the SaaS provider, the developer, or the coding assistant session before the hijack.

2. Trust Manipulation - Active. Through trusted recommendation abuse, the attacker turned the compromised coding assistant session into a trust channel inside the developer's workflow. The assistant operated within the developer environment and recommended an attacker-poisoned external package. As a result, the dependency arrived through a recommendation path the developer already relied on.

3. Input & Instruction Weaponization - Bypassed entirely. Not disclosed. Mandiant does not disclose the method used to take over the original AI session, and no weaponized prompt, instruction, or input is described.

4. Reasoning-Time Execution - Active. Through false-premise anchoring, the attacker established the premise that the poisoned package was a legitimate dependency. The coding assistant acted on that premise and recommended installing it, and the recommendation was accepted.

5. Tool Invocation - Active. Through unauthorized tool invocation, the compromised session caused installation of the attacker-controlled package. This used a capability outside the legitimate developer intent. Once the recommendation was accepted, the attacker used the developer's active session to install an infostealer through the poisoned PyPI package.

6. Privilege Escalation - Active. Through credential overreach, the attack leveraged credentials available to the compromised developer workflow. The infostealer harvested GitHub OAuth tokens, which the attacker then used to expand access into internal repositories.

7. Lateral Movement - Active. Through trust domain pivoting, stolen access let the attacker move from the developer workstation into internal GitHub repositories and software development infrastructure. That is where Shai-Hulud was deployed.

8. Persistence - Active. Through supply chain abuse, malicious components remained embedded in trusted repositories and package paths. This allowed the compromise to recur through normal dependency use rather than depending on the original hijacked session.

9. AI-Native C2 - Bypassed entirely. Not disclosed. The report does not describe a command-and-control channel.

10. Action on Objectives - Active. Through supply chain propagation, the self-propagating Shai-Hulud worm spread across approximately 100 internal repositories. It automated theft of repository secrets and programmatically exfiltrated proprietary product source code. The attacker then poisoned a package inside the organization's own namespace, and another employee pulling that compromised version caused a secondary infection.

Mitigation Strategy

Pre-Ingestion Supply Chain Screening

Block malicious or high-risk components before installation. Applied here, the poisoned PyPI package should be validated before the AI recommendation can result in installation.

Mandiant specifically recommends IDE and CLI verification hooks that validate AI recommended third party dependencies against cryptographic checksums and approved allowlists.

Route Dependency Installation Through Approved Repositories

Mandiant recommends restricting developer workstation egress so dependency traffic passes through controlled internal repositories rather than arbitrary external package sources.

Protect Developer Credentials

Mandiant also recommends isolating local credentials so extensions and assistant processes cannot access raw API keys, long-lived OAuth tokens, or secrets. For this incident, restricting the AI assisted development environment from freely accessing GitHub OAuth tokens would reduce the ability of a malicious package to pivot into repository infrastructure.

Lineaje UnifAI

• Lineaje scans and classifies OSS software, MCP servers, and agentic skills as benign, suspicious, or malicious, enabling organizations to block malicious dependencies before they reach or execute on developer workstations.
• URL allowlist policies can restrict agents to approved repositories and endpoints, preventing them from downloading packages or other content from untrusted public sources.

The Recommendation Was The Payload

This incident demonstrates that an AI coding assistant can become a supply-chain entry point even when the underlying malicious component is conventional malware.

The attacker did not need the AI assistant to generate exploits or autonomously compromise repositories. By hijacking a trusted developer session, the attacker used the assistant’s recommendation path to introduce a poisoned dependency. Once installed, the attack shifted into a traditional supply chain compromise involving credential theft, repository propagation, secret theft, source-code exfiltration, and downstream package poisoning.

The key security lesson is: AI generated dependency recommendations must be subject to the same, or stronger, software supply chain validation as manually selected dependencies.