Mini Shai-Hulud Compromises 639 npm Package Versions in AntV-Heavy Campaign

May 19, 2026 · Original article ↗

Summary

Socket reports 639 compromised npm package versions across 323 packages in a Mini Shai-Hulud wave. The obfuscated install-time payload targets developer secrets, exfiltrates data, and can republish malicious packages using stolen npm tokens.

Key points

Socket identified 639 compromised versions across 323 packages in the latest npm wave, concentrated in @antv packages and including echarts-for-react.
The campaign-wide count reported by Socket is 1,055 versions across 502 packages spanning npm, PyPI, and Composer.
A malicious preinstall hook runs an obfuscated Bun-based payload embedded in package index.js files.
The malware searches developer and CI/CD environments for tokens, cloud credentials, SSH keys, Kubernetes material, and other secrets.
Stolen data is compressed, encrypted, and sent to a hardcoded endpoint; a GitHub-token fallback can create repositories and commit stolen data.
The payload can use stolen npm credentials to enumerate, modify, and republish packages, enabling further propagation.
Socket says it detected most of the 639 newly published versions within about 6–12 minutes; investigation of the campaign is ongoing.

Article Details

Attack Vectors: Compromised npm maintainer credentials enable coordinated publication of malicious dependency versions, exposing developer and CI/CD environments that install them.
Injected package.json preinstall hooks execute a root-level index.js payload with Bun during dependency installation.
A malicious git-based optional dependency provides an additional package lifecycle execution path.
The payload harvests development secrets and contains worm-like logic to validate stolen npm tokens, enumerate maintainable packages, inject malicious code, increment versions, and republish packages under the compromised maintainer's identity.
Collected secrets are transmitted to a hardcoded HTTPS endpoint after compression and encryption; a fallback uses a stolen GitHub token to create a repository under the victim's account and commit stolen data.
Defensive Notes: Socket classified the affected versions as known malware; organizations automatically installing newly published dependency versions face downstream exposure.
Unexpected npm token-validation, identity, or maintainer-search API requests from package lifecycle scripts, dependency installations, or non-publishing CI jobs are detection opportunities.
Unexpected access to Sigstore signing-certificate and transparency-log APIs from those execution contexts may indicate provenance or signing abuse.
The referenced npm and Sigstore endpoints are legitimate services, not attacker-controlled infrastructure, and should not be blocked by default.
Reversed Shai-Hulud repository-description markers, Dune-themed repository names, and results/results-*.json files can help identify GitHub fallback exfiltration activity.
Payload string obfuscation hinders simple static inspection, while encrypted exfiltration prevents easy recovery of stolen plaintext from network telemetry.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`t[.]m-kosche[.]com`	Domain explicitly listed as a network indicator and used by the payload's hardcoded HTTPS exfiltration endpoint.
URL	`hxxps[:]//t[.]m-kosche[.]com/api/public/otel/v1/traces`	Hardcoded HTTPS endpoint receiving compressed and encrypted secrets collected from developer and CI/CD environments.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe payload uses a large string-array lookup table, runtime string decoding, and a custom decryptor to conceal sensitive strings.T1059.007 · JavaScriptThe injected index.js JavaScript payload executes through the preinstall command bun run index.js.T1140 · Deobfuscate/Decode Files or InformationRuntime decoding and the globalThis decryptor fc2edea72 reveal endpoint strings, API references, paths, and execution markers.T1195.001 · Compromise Software Dependencies and Development ToolsCompromised npm packages distribute an injected install-time payload through malicious versions published under compromised maintainer identities.T1550.001 · Application Access TokenStolen npm tokens support package enumeration and malicious republishing; a usable GitHub token enables repository creation and stolen-data commits.T1552.001 · Credentials In FilesThe payload searches developer and CI/CD environments for credential files and secrets, including AWS credentials, Docker authentication files, and database connection strings.T1552.004 · Private KeysSSH/private keys are explicitly identified among the payload's secret-harvesting targets.T1560.001 · Archive via UtilityCollected data is serialized and compressed with gzip before encryption and transmission.T1567.001 · Exfiltration to Code RepositoryThe fallback exfiltration mechanism creates a GitHub repository under the victim's account and commits stolen data into results/results-<timestamp>-<counter>.json files.

Malware

ChainDropSocket’s internal review identified hundreds of unique packages. The pattern matches Mini Shai-Hulud, a high-volume npm compromise pattern involving coordinated malicious publishes across packages tied to a compromised

Products