Critical Mini-ShaiHulud Supply Chain Attack Compromises 600+ npm Packages

Key Takeaways

• The “Mini Shai-Hulud” supply chain attack has compromised over 600 npm package versions in a recent wave.
• The attack targets developer and CI/CD environments to steal sensitive credentials, including GitHub, npm, AWS, Kubernetes, and Vault tokens.
• The malware self-propagates by abusing stolen npm tokens to inject payloads into other packages and republish them under legitimate maintainer identities.
• Novel tactics include exploiting long-dormant accounts, using a single token for namespace takeover, and abusing Sigstore to display fake provenance badges.
• Immediate auditing of affected packages, credential rotation, and network blocking of the C2 server are critical mitigation steps.

Sophisticated Supply Chain Attack Hits npm Ecosystem

A widespread and sophisticated supply chain attack, identified as “Mini Shai-Hulud,” has recently impacted the npm ecosystem, compromising more than 600 package versions in a single malicious wave. Cybersecurity researchers at Socket and Endor Labs collaboratively identified 639 compromised package versions spanning 323 unique npm packages.

The latest activity predominantly targeted packages within the @antv ecosystem, in addition to those under the @lint-md, @openclaw-cn, and @starmind scopes. This malicious publishing spree commenced on May 19, 2026, at approximately 01:56 UTC and continued for an hour, concluding around 02:56 UTC.

Socket’s detection systems proved effective, flagging the majority of the malicious activity within 6 to 12 minutes of publication, with a median detection time of 6.7 minutes. Independently, Endor Labs observed 42 malicious packages between 01:39 and 02:06 UTC, tracing the campaign’s genesis to two previously inactive packages: jest-canvas-mock and size-sensor. Both packages had not seen updates in over three years, indicating a strategic exploitation of dormant accounts.

To date, the full Mini Shai-Hulud campaign has seen 1,055 compromised versions across 502 distinct packages. This includes 1,048 versions on npm, 6 on PyPI, and 1 on Composer, highlighting the cross-platform ambition of the attackers.

Malicious Payload and Data Exfiltration

The injected malware executes during package installation via a preinstall lifecycle hook, specifically: "preinstall": "bun run index.js". A root-level index.js file, heavily obfuscated with a string-array lookup table and a custom decryptor, runs automatically when the package is installed.

Stolen data is exfiltrated to a hardcoded HTTPS endpoint: https://t[.]m-kosche[.]com:443/api/public/otel/v1/traces. To evade detection and prevent recovery, the collected data is compressed using gzip, encrypted with AES-256-GCM, and its AES key is then wrapped with RSA-OAEP/SHA-256 before transmission.

The payload is designed to aggressively target development and CI/CD environments, harvesting a wide array of sensitive credentials and secrets:

• GitHub tokens, npm tokens, and AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
• Kubernetes service account details (KUBECONFIG, KUBERNETES_SERVICE_HOST)
• Vault tokens (VAULT_TOKEN, VAULT_AUTH_TOKEN)
• SSH/private keys, Docker authentication files, and database connection strings

The malware explicitly includes logic to target over 18 CI/CD platforms, including GitHub Actions, GitLab CI, CircleCI, Jenkins, Azure DevOps, AWS CodeBuild, Vercel, Netlify, and Cloudflare Pages. If a valid GitHub token is compromised, the payload creates new repositories under the victim’s account and commits the stolen data into a path structured as results/results-<timestamp>-<counter>.json.

Public GitHub searches have revealed approximately 1,900 attacker-created repositories using the reversed campaign marker niagA oG eW ereH :duluH-iahS, which decodes to “Shai-Hulud: Here We Go Again.” These repositories often feature Dune-themed names, such as sayyadina-stillsuit-852 and atreides-ornithopter-112. The repository Zaynex/sayyadina-stillsuit-852 has been confirmed as an active exfiltration staging point.

The worm further exploits stolen npm tokens to enumerate other packages maintainable by the victim, inject the malicious payload, increment version numbers, and republish them. This mechanism allows the malware to self-propagate across the npm ecosystem under the guise of legitimate maintainer identities.

Novel Attack Vectors Identified

Endor Labs highlighted three significant new behaviors in this iteration of the attack:

• Sigstore Abuse: The malware now interacts with Fulcio and Rekor at runtime to acquire valid signing certificates and transparency log entries. This sophisticated tactic causes provenance tooling to display a green badge, falsely indicating a legitimate build chain despite the underlying malicious activity.
• Dormant Account Targeting: Entry points for the attack included packages like jest-canvas-mock, size-sensor, and timeago.js, which had been dormant for 3 to 10 years. Older, less monitored accounts were strategically chosen to attract minimal scrutiny.
• Single-Token Namespace Takeover: At least 37 packages within the @antv/* namespace have been confirmed as malicious. This suggests that a single stolen token likely held publishing rights across the entire namespace, enabling a broad compromise from a single breach.

Indicators of Compromise

What You Should Do

Organizations and developers are urged to take immediate action to mitigate potential compromise:

• Conduct an urgent audit of all recently updated packages, especially those under @antv/*, @lint-md, @openclaw-cn, and @starmind scopes.
• Immediately rotate any GitHub tokens, npm tokens, AWS credentials, and Vault tokens that may have been exposed in CI/CD environments.
• Do not solely rely on Sigstore provenance badges as the definitive indicator of package integrity due to the observed abuse.
• Implement monitoring for npm install logs to detect unexpected preinstall scripts that invoke bun.
• Block outbound network connections to the identified command and control (C2) endpoint, t[.]m-kosche[.]com, at your network perimeter.

Socket and Endor Labs have both released detailed advisories, including a comprehensive list of affected packages. Any organization using these compromised packages should assume that exposed credentials are fully compromised and activate their incident response protocols without delay.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.