Shai-Hulud searches 469 places now, and the new ones include your AI tool config
2026-09-09Security
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.