--- title: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes... description: AI music startup Suno was breached via the Shai-Hulud worm, which compromised a single employee's machine to harvest GitHub and cloud credentials. The leaked... canonical: https://daily.dev/posts/suno-breached-via-shai-hulud-worm-leaked-code-exposes-ai-mu--xxvrk4yfh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu... | daily.dev og:description: AI music startup Suno was breached via the Shai-Hulud worm, which compromised a single employee's machine to harvest GitHub and cloud credentials. The leaked... og:url: https://daily.dev/posts/suno-breached-via-shai-hulud-worm-leaked-code-exposes-ai-mu--xxvrk4yfh og:image: https://api.daily.dev/og/posts/xxVRk4YfH.png og:image:alt: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu... **[Socket](https://daily.dev/sources/socketdev)** · 3 min read · 0 upvotes · 0 comments ## Summary AI music startup Suno was breached via the Shai-Hulud worm, which compromised a single employee's machine to harvest GitHub and cloud credentials. The leaked source code reveals Suno scraped YouTube Music, Deezer, Genius, and other platforms to train its AI models, confirming RIAA claims about stream-ripping. The attacker accessed source code, customer records, and Stripe payment data. Suno confirmed the November 2025 incident but described it as limited. Shai-Hulud, a credential-harvesting worm that spreads through npm and GitHub, has been active since September 2025 with multiple evolving variants targeting developer toolchains. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Shai-Hulud copycat worm infects yet another npm package](https://daily.dev/posts/shai-hulud-copycat-worm-infects-yet-another-npm-package-6qyti32ms) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/suno-breached-via-shai-hulud-worm-leaked-code-exposes-ai-mu--xxvrk4yfh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu...","url":"https://daily.dev/posts/suno-breached-via-shai-hulud-worm-leaked-code-exposes-ai-mu--xxvrk4yfh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/suno-breached-via-shai-hulud-worm-leaked-code-exposes-ai-mu--xxvrk4yfh"},"datePublished":"2026-07-16T18:16:16.140Z","dateModified":"2026-07-16T18:17:02.417Z","description":"AI music startup Suno was breached via the Shai-Hulud worm, which compromised a single employee's machine to harvest GitHub and cloud credentials. The leaked...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30a9c73e409087c4e34bab0ae8ff662f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30a9c73e409087c4e34bab0ae8ff662f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/suno-breached-via-shai-hulud-worm-leaked-code-exposes-ai-mu--xxvrk4yfh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu..."}]} ```