AFP sizes the Shai-Hulud syndicate's take at more than 500,000 credentials

Each stolen token was both loot and transport. The worm used harvested npm and GitHub credentials to publish tampered packages and modify repositories, which delivered it into the next developer environment ^[7]. That loop has one throttle a defender actually owns, and it is how long a token stays valid.

Shai-Hulud surfaced publicly in late 2025, against corporate cloud environments ^[9]. The one window with hard public numbers came later. CloudSEK data analyzed by StepSecurity, cited by Suzu Labs' Jacob Krell, counted 78,330 secrets pulled from the CI/CD pipelines of 2,186 organizations over five days in March, including public companies with a combined market capitalization above $6 trillion ^[12]. Work the arithmetic: about 15,700 secrets a day ^[13], and roughly 36 per victim organization ^[14]. Set against the AFP's 500,000-plus, that single five-day stretch accounts for around 16 percent of the syndicate's entire alleged credential take ^[15]. Either the police figure is a floor assembled from confirmed cases, or March ran hotter than the rest of the campaign. Both readings land on the same control.

The distribution model is why the tooling outlives the defendants. According to Krell, TeamPCP did not gate access through an affiliate structure the way ransomware crews do. It released Shai-Hulud as open-source attack tooling and crowdsourced deployment through a paid contest ^[5]. Krell also points to KrebsOnSecurity's description of the group's activity as the longest-running spree of software supply chain attacks on record ^[8]. Public code with a documented technique and a proven yield can keep working long after its authors are gone.

That number reads as an inventory of exposure, tallying what sat exposed long enough to be scanned, rather than a running scoreboard of victims. More than 500,000 credentials ^[2] measures how many npm tokens, GitHub credentials and cloud provider secrets sat in developer environments and build configs long enough for a scanner the attackers pointed at them to find ^[7]. Each one that had already expired blocked a propagation step before it could happen. Token lifetime is the only variable in that equation that the victim sets.