Mini Shai-Hulud Campaign Affects More Than 320 npm Packages
Summary
Researchers report that a fresh Mini Shai-Hulud campaign affected more than 320 npm packages and related GitHub Actions and a VS Code extension, using payloads to steal CI/CD secrets and credentials, establish persistence, and enable remote execution.
Key points
- Researchers report more than 320 npm packages affected. Socket separately tracks 1,055 versions across 502 packages in npm, PyPI, and Composer for the broader campaign.
- The npm maintainer account “atool” was reportedly compromised and used to publish malicious versions, including packages in the @antv namespace and downstream packages such as echarts-for-react.
- Researchers say the payload can read GitHub Actions runner memory to extract masked CI/CD secrets and harvest credentials from more than 130 file paths covering cloud services, Kubernetes, Vault, wallets, and developer tools.
- According to researchers, stolen data is exfiltrated through GitHub repositories and a fallback server; StepSecurity identified more than 2,200 repositories containing exfiltrated data.
- Socket says the payload can use npm tokens to enumerate packages, inject malicious code, add a preinstall hook, and republish modified packages.
- Wiz says the malware downloads and executes Python code from attacker infrastructure and drops persistent backdoors into Claude Code. Researchers linked the campaign to TeamPCP, but the article presents this as a suggestion.
- StepSecurity reported three malicious PyPI versions of Microsoft’s Durabletask Python SDK uploaded within 35 minutes; Wiz also linked a compromise of the actions-cool/issues-helper GitHub Action to the campaign.
Article Details
- Event Type
- Software supply-chain attack involving compromised NPM maintainer credentials and malicious package releases, with additional compromises involving PyPI and a GitHub Action.
- Impact
- Researchers report that the attack affected over 320 NPM packages. Socket reported roughly 639 malicious versions in the fresh attack and, across the broader Mini Shai-Hulud campaign, 1,055 versions across 502 packages. The payloads reportedly stole CI/CD secrets and other credentials, established persistence, and exfiltrated data through GitHub repositories and a fallback server; StepSecurity identified over 2,200 GitHub repositories containing exfiltrated data. The attack also reportedly enabled remote execution on compromised systems.
MITRE ATT&CK
T1059.006 · PythonWiz reported that the malware downloaded and executed Python code from attacker infrastructure.T1195.002 · Compromise Software Supply ChainCompromised package-maintainer access was used to publish malicious software packages, consistent with a software supply-chain compromise.T1552.001 · Credentials In FilesThe payload reportedly harvested credentials from more than 130 file paths.T1567.001 · Exfiltration to Code RepositoryStolen data was reportedly exfiltrated through GitHub repositories.
Threat Actors
Malware
Vendors
Products
actions-cool/issues-helperA fresh compromise of the popular GitHub Action actions-cool/issues-helper can also be linked to this campaign, Wiz says.Claude CodeStepSecurity also observed the payload dropping persistent backdoors into Claude Code, and identified over 2,200 GitHub repositories containing exfiltrated data.Durabletask Python SDKMicrosoft’s Durabletask Python SDK was also compromised in the fresh Mini Shai-Hulud campaign, with three malicious versions uploaded to PyPI within a 35-minute window, StepSecurity says.echarts-for-reactThe attack propagated downstream to other highly popular packages, including echarts-for-react (~1.1 million weekly downloads), “impacting a much broader set of applications and continuous integration (CI)GitHub ActionsA fresh Mini Shai-Hulud supply chain attack has hit over 320 NPM packages, along with GitHub Actions and a VS Code extension, security researchers report.timeago.jsaccount ‘atool’, which has access to multiple packages across the @antv namespace, and which publishes timeago.js (1.5 million weekly downloads), was compromised and used to publish malicious package versions.