What Happened
An attacker took over an active AI coding assistant session at an unnamed software provider and used it to install an infostealer through a poisoned PyPI package. The compromised session gave the attacker a foothold to steal GitHub OAuth tokens, letting the intrusion spread across roughly 100 internal code repositories. The attacker went further, planting a poisoned package inside the company’s own official namespace, which infected a second employee who downloaded it in the ordinary course of work.
Mandiant, which investigated the incident, ties the malware to the Shai-Hulud family, a self-spreading worm repeatedly using compromised developer credentials to jump from one package or repository to the next. Read the technical writeup from The Hacker News.
Why This Matters for Canadian Organizations
Canadian development teams have felt this malware family directly more than once this year, from the Keyv npm worm planting IDE backdoors in tools including VS Code and Claude Code, to the TanStack and Miasma campaigns sweeping through widely used open-source namespaces. This incident marks a shift in the pattern. Instead of waiting for a developer to install a poisoned package, the attacker rode an already-trusted AI coding session directly, turning a productivity tool into the entry point.
Canadian fintech, government digital service, and software teams increasingly grant AI coding assistants standing access to repositories, package registries, and credentials, often with fewer controls than a human developer would face. Under OSFI Guideline B-13 and PIPEDA, a breach reaching source code or customer-facing credentials through a compromised development pipeline carries the same reporting and remediation duties as any other intrusion, regardless of whether an AI tool sat in the middle of it.
What to Do
Mandiant recommends verifying AI-suggested dependencies against checksums and an approved package list before installation, restricting AI coding extensions from reading local secrets stores, and routing dependency traffic through an internal, controlled registry rather than public repositories directly. Audit AI coding tool permissions the same way you would a new employee’s access grant, and rotate OAuth tokens for any repository an AI assistant session touched during the affected window.
Read more AI supply chain coverage in our Trends section and daily updates in News.
