--- title: Shai-Hulud Credential Stealer Blocked by Python Linter description: A threat actor compromised a co-founder's GitHub account for gpt-pilot (33K stars) and force-pushed the Shai-Hulud credential-stealing malware to the main... canonical: https://daily.dev/posts/shai-hulud-credential-stealer-blocked-by-python-linter-nvzcfrixe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Shai-Hulud Credential Stealer Blocked by Python Linter | daily.dev og:description: A threat actor compromised a co-founder's GitHub account for gpt-pilot (33K stars) and force-pushed the Shai-Hulud credential-stealing malware to the main... og:url: https://daily.dev/posts/shai-hulud-credential-stealer-blocked-by-python-linter-nvzcfrixe og:image: https://api.daily.dev/og/posts/NVzcFrIXe.png og:image:alt: Shai-Hulud Credential Stealer Blocked by Python Linter og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Shai-Hulud Credential Stealer Blocked by Python Linter **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 12 min read · 0 upvotes · 0 comments ## Summary A threat actor compromised a co-founder's GitHub account for gpt-pilot (33K stars) and force-pushed the Shai-Hulud credential-stealing malware to the main branch. The attack was stopped twice by the ruff Python linter, which flagged formatting and import-ordering violations in the injected code, causing all CI jobs to fail. The malware itself is a sophisticated 758KB obfuscated JavaScript payload running under Bun that targets AWS keys, npm tokens, GitHub secrets, Kubernetes service accounts, and SSH keys. It uses GitHub commit searches as a covert C2 channel, exfiltrates data by creating GitHub repos, abuses Sigstore to sign malicious npm packages with valid SLSA attestations, and plants persistence hooks in Claude Code and VS Code. The incident highlights branch protection gaps, the accidental security value of code quality tooling, and the growing Shai-Hulud campaign that has already hit Microsoft, Red Hat, and Mistral AI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting](https://daily.dev/posts/shai-hulud-copycat-campaign-targets-python-developers-through-pypi-typosquatting-sx3wjf52s) · GitLab · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/shai-hulud-credential-stealer-blocked-by-python-linter-nvzcfrixe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Shai-Hulud Credential Stealer Blocked by Python Linter","url":"https://daily.dev/posts/shai-hulud-credential-stealer-blocked-by-python-linter-nvzcfrixe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/shai-hulud-credential-stealer-blocked-by-python-linter-nvzcfrixe"},"datePublished":"2026-06-08T20:04:14.302Z","dateModified":"2026-06-08T20:04:44.014Z","description":"A threat actor compromised a co-founder's GitHub account for gpt-pilot (33K stars) and force-pushed the Shai-Hulud credential-stealing malware to the main...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d195c32b2d157a063d923550a3adde98?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d195c32b2d157a063d923550a3adde98?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/shai-hulud-credential-stealer-blocked-by-python-linter-nvzcfrixe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,python,github-actions","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Shai-Hulud Credential Stealer Blocked by Python Linter"}]} ```