Malicious software packages can steal cloud credentials during installation, exposing developer workstations and continuous integration and delivery (CI/CD) pipelines before an application runs.
These attacks turn routine dependency updates into potential entry points for cloud account compromise. The threat centers on installation scripts that execute with the permissions of the developer or build runner.
A successful build does not prove the environment is safe. Malicious code may already have collected secrets and sent them to infrastructure controlled by attackers.
Developer environments often contain AWS access keys, GitHub tokens, Azure credentials, Google Cloud service account keys, Kubernetes configuration files, and npm publishing tokens.
When these secrets carry broad permissions, a compromised dependency can expose resources far beyond the affected software project.
Malicious Packages Steal Credentials
The supplied research describes campaigns targeting trusted packages and development tools across npm, RubyGems, Go, PyPI, and container registries.
Their shared approach is to execute malicious code, harvest available credentials, and use those credentials to expand access.
The Shai-Hulud campaign illustrates this pattern. According to the supplied material, infected npm packages searched developer and build environments for secrets.
Later variants used preinstall hooks, allowing credential theft to begin before the installation process finished.
Other campaigns targeted the build host itself. Malicious developer utilities reportedly changed Go settings, planted command wrappers, or added attacker SSH keys.
Such changes can preserve access and affect later commands, even after teams remove the original package.
Compromised security tools create another risk because pipelines routinely trust scanners with access to repositories and secrets. The supplied account describes TeamPCP using trusted tooling to deliver credential theft payloads.
Once stolen credentials reach attackers, legitimate cloud APIs become the next attack surface. Depending on permissions, attackers may inspect storage, retrieve secrets, create resources, or establish persistence.
Defenders therefore need to investigate identity activity, not just package files. Security teams should first identify every credential accessible to the affected workstation or runner.
Revoke exposed tokens, rotate keys, isolate compromised hosts, and preserve logs for investigation. Removing the malicious dependency alone does not terminate access granted by stolen credentials.
Review cloud audit records across the exposure window. Investigate unfamiliar API calls, new identities, changed permissions, unexpected resources, and disabled logging.
Publishing credentials also require attention because attackers may use them to compromise additional packages. Prevention should reduce installation trust and credential availability.
Restrict package lifecycle scripts where compatible, approve dependencies, and enforce lockfiles. Separate build tasks from deployment privileges and favor narrowly scoped, short-lived credentials over stored keys.
Protect cloud metadata endpoints where runners do not need access. Require AWS IMDSv2, while recognizing that metadata protections do not replace least privilege or host security.
Qualys says TotalCloud combines cloud inventory, posture, identity, workload, and runtime security across supported environments.
Its TruRisk engine correlates vulnerabilities, misconfigurations, entitlements, and threat intelligence to prioritize exposures.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
