Critical antv npm Vulnerability Steals CI/CD Credentials

Key Takeaways

• A sophisticated supply chain attack, dubbed “Mini Shai-Hulud,” compromised the @antv npm package ecosystem, impacting widely used data visualization libraries.
• Threat actors gained access to a maintainer account, publishing malicious versions of packages that automatically executed a payload upon npm install.
• The malware was designed to steal credentials from GitHub Actions environments and connected cloud services, including AWS, HashiCorp Vault, Kubernetes, npm, and 1Password.
• Microsoft security researchers identified the campaign, leading to GitHub’s swift action, including the removal of 640 malicious packages and invalidation of over 61,000 npm tokens.
• The situation has been resolved by @antv account authors, and mitigation steps have been recommended for affected developers.

A highly advanced supply chain attack, dubbed “Mini Shai-Hulud,” has been uncovered, targeting a critical segment of the open-source software landscape. This campaign specifically compromised the @antv npm package ecosystem, a suite of popular data visualization libraries relied upon by developers globally for dashboards and applications.

The attack was characterized by its stealth and precision, designed to maximize damage before detection. It leveraged a compromised maintainer account within the @antv organization to distribute malicious versions of widely used packages. This strategic compromise allowed the malicious code to propagate downstream into dependent libraries, notably echarts-for-react, which alone boasts over one million weekly downloads. Consequently, a single compromised package could silently infect thousands of developer pipelines almost instantaneously.

Microsoft security researchers were instrumental in identifying and reporting this elaborate campaign, detailing the full extent of the malware’s capabilities. According to a Microsoft report, the malicious payload was an approximately 499 KB obfuscated JavaScript file. It was engineered to execute immediately upon a developer typing npm install, with its primary objective being the exfiltration of credentials from GitHub Actions environments and associated cloud services.

The payload systematically targeted secrets across six distinct platforms: Amazon Web Services, HashiCorp Vault, Kubernetes, npm, and 1Password. It achieved this by directly scraping process memory from the GitHub Actions runner, effectively circumventing standard secret masking protocols. The sophisticated nature of the malware, evident in every layer, indicated a calculated effort to harvest credentials and then vanish without triggering alerts.

Upon notification, GitHub responded decisively, removing 640 malicious packages and invalidating more than 61,000 npm tokens with write permissions. Dependabot alerts and npm audit warnings were subsequently issued to assist developers in identifying and addressing the compromise. The authors of the @antv account have since confirmed that the situation has been fully resolved.

Mini Shai-Hulud Compromises @antv npm Packages

The attack vector was meticulously planned and executed. After successfully gaining unauthorized access to a maintainer account, the threat actor proceeded to publish tainted versions of crucial charting packages. A preinstall hook embedded within these packages ensured that the malicious payload automatically triggered during the npm install process, eliminating the need for developers to execute any additional commands for the infection to commence.

The JavaScript payload employed a dual-layer obfuscation strategy. The initial layer involved 1,732 Base64-encoded strings, randomly shuffled within a rotated array. The second layer utilized a custom cipher, based on PBKDF2 and SHA-256, which only decoded critical strings during runtime. To further evade detection during routine testing, the malware incorporated environment gating, causing it to terminate immediately if not operating within a GitHub Actions Linux environment.

Once activated, the malware utilized two distinct channels for data exfiltration. Its primary method involved an encrypted HTTPS connection to a command-and-control domain on port 443. As a fallback mechanism, it exploited GitHub’s Git Data API to create commits in victim repositories on non-protected branches. At the time of reporting, researchers had identified over 2,200 public repositories created under compromised accounts, serving as a distinct signature of the campaign.

Credential Theft Across Cloud and CI/CD Environments

The breadth of credential theft capabilities exhibited by the malware was notable. For AWS, the payload queried the Instance Metadata Service and invoked SecretsManager across all regions. In the case of HashiCorp Vault, it systematically searched over twelve token paths. For Kubernetes, it was programmed to read service account tokens and enumerate namespace secrets. Furthermore, for 1Password, it even attempted to bypass two-factor authentication to extract master passwords.

Beyond credential exfiltration, the malware also established persistence mechanisms. It installed the Bun runtime to execute a second-stage payload, injected a passwordless sudo rule via a bind mount, and manipulated DNS settings by modifying the hosts file. Additionally, it forged software supply chain provenance attestations through Sigstore, a tactic aimed at lending legitimacy to the malicious packages.

What You Should Do

• Review your project’s dependency trees for any use of affected @antv packages.
• Run npm install with the --ignore-scripts flag to prevent automatic execution of malicious scripts.
• Pin your dependencies to known-good versions of @antv packages, ensuring you are not using compromised releases.
• Immediately rotate any credentials that may have been exposed, including those for AWS, HashiCorp Vault, Kubernetes, npm, and 1Password.
• Audit your GitHub accounts for any unexpected public repositories created during the suspected compromise window, as these could indicate an ongoing breach.
• Implement stricter access controls and multi-factor authentication for all CI/CD environments and package maintainer accounts.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.