# Hades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)

- **Severity:** Critical
- **Signature ID:** `e0dbcfec-05e7-4add-a1b0-95ee47c63c30`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI03 (Identity and Impersonation), ASI04 (Memory and Context Poisoning), LLM03 (Supply Chain), LLM06 (Excessive Agency)

## Summary

Fake or typosquatted AI-tooling packages (imitating things like langchain-core-mcp or openai-mcp) run a credential stealer the moment they're installed, grabbing Anthropic API keys, Claude configuration files, and other secrets, then sending them to an attacker-controlled server. This is a supply-chain attack targeting developers who use AI coding agents.

## How the attack works

An attacker publishes a package with a name close to a real MCP or AI-library package. When a developer installs or imports it, embedded code runs automatically and searches for AI-agent secrets — ANTHROPIC_API_KEY, Claude desktop/Code config files, .mcp.json — as well as broader credentials like .npmrc, .pypirc, SSH keys, and cloud credentials. The stolen data is immediately sent out over the network to an address controlled by the attacker. This detection looks specifically for code that reads one of these AI-agent secrets and is closely followed by an outbound network call, or for a broad credential sweep that happens to include an AI-agent secret.

## Why it matters

Stolen Anthropic API keys and MCP/Claude configuration let an attacker impersonate the victim's AI agent, run up usage costs, access connected tools and data sources the agent was configured to reach, and pivot into other systems if the harvested secrets included SSH or cloud credentials.

## What you can do

- Pin dependencies and vet package names carefully before installing anything with 'mcp' in the name — check for typosquatting against known libraries.
- Store ANTHROPIC_API_KEY, Claude config files, and .mcp.json outside of general-purpose environment dumps, and restrict which processes can read them.
- Run installs and builds in a sandboxed or network-restricted environment so a malicious install script can't reach an external server.
- Rotate any AI-agent or cloud credentials that were present on a machine where an untrusted package was installed, even if no theft was confirmed.

## Known benign look-alikes

- Legitimate code that reads ANTHROPIC_API_KEY from the environment to call the API, with NO co-located outbound send of the secret to an arbitrary host (the patterns require an AI-agent credential/config surface AND a network exfil within ~250 chars).
- An SDK that posts to the real Anthropic/OpenAI endpoint — the exfil token must co-locate with the credential read, and benign SDK calls send a request body, not the credential file contents; review flagged hits before blocking a first-party SDK.
- Security writeups describing the Hades / Shai-Hulud campaign in prose without an actual credential-read + exfil artifact.
- RUNTIME/STATIC LIMITATION: a variant that base64/char-code-builds the credential path or the exfil host so the literal tokens never appear can evade a pattern match (see evasion_tests).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00576

---
Source: https://www.netzilo.com/threats/atr-hades-shai-hulud-ai-agent-credential-harvester-in-supply-cha