cyber.hendryadrian.com
Security News · bleepingcomputer.com

Shai-Hulud Campaign Publishes 639 Malicious Versions Across 323 npm Packages

· Original article ↗

Summary

A new Shai-Hulud wave published 639 malicious versions across 323 npm packages, mostly targeting @antv. The malware steals developer and CI/CD secrets, exfiltrates them via Session and GitHub, and can generate valid-looking Sigstore attestations.

Key points

  • Socket reported 639 malicious versions across 323 packages published in about one hour on May 19; the attack began with compromise of the npm account atool.
  • Most affected packages were in the @antv ecosystem, with other popular packages also targeted.
  • The payload targets developer workstations and CI/CD environments, stealing credentials for services and systems including GitHub, npm, cloud platforms, Kubernetes, and SSH.
  • Stolen data is primarily exfiltrated through Session P2P; when GitHub credentials are available, the malware can upload data to repositories created under victims’ accounts.
  • The malware can self-propagate to packages owned by victims and abuse CI OIDC tokens to generate valid Sigstore provenance attestations, potentially making malicious packages appear legitimate.
  • Aikido reported persistence backdoors in VS Code and Claude Code configurations; researchers say attribution is difficult because Shai-Hulud code was leaked.
  • Developers who downloaded infected packages are advised to remove or downgrade them to a known-good version published before May 18, then revoke and rotate exposed credentials.

Article Details

Event Type
npm software supply-chain malware campaign
Impact
Socket reported 639 malicious versions across 323 npm packages published in about one hour, primarily affecting the @antv ecosystem. The malware steals developer and CI/CD credentials, exfiltrates data through Session P2P and sometimes GitHub repositories under victims’ accounts, and can spread by republishing infected packages. The article also reports persistence via backdoors in VS Code and Claude Code configurations and the abuse of OIDC tokens to generate valid Sigstore provenance attestations.

Indicators of compromise

TypeIndicatorContext
DOMAINt[.]m-kosche[.]comEndpoint Microsoft shared as being used to ship stolen credentials.
HOSTNAMEfilev2[.]getsession[.]orgReported main exfiltration endpoint used to send stolen credentials over the Session P2P network.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe campaign compromised npm packages and published malicious package versions, a software supply-chain compromise.T1567.001 · Exfiltration to Code RepositoryWhen GitHub credentials were available, the malware uploaded stolen data to repositories created under victims’ accounts.

Threat Actors

TeamPCPThe article says TeamPCP leaked Shai-Hulud code on GitHub and that the code has since been used in attacks. It notes that attribution of this campaign is more difficult; the article does not confirm TeamPCP carried out this new wave.

Malware

Shai-HuludThreat actors published 639 malicious npm package versions across 323 packages in the Shai-Hulud supply-chain campaign, mainly compromising the @antv ecosystem and using stolen secrets from developer and CI/CD

Products

Azure DevOpsIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.CircleCIIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.Claude CodePersistence via VS Code and Claude CodeGitHubThe malware exfiltrates credentials through Session P2P and GitHub, creates rogue repositories under victim accounts, and may appear legitimate by generating valid Sigstore provenance attestations.GitHub ActionsIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.GitLab CIIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.JenkinsIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.NetlifyIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.npmThreat actors published 639 malicious npm package versions across 323 packages in the Shai-Hulud supply-chain campaign, mainly compromising the @antv ecosystem and using stolen secrets from developer and CI/CDSigstoreThe malware exfiltrates credentials through Session P2P and GitHub, creates rogue repositories under victim accounts, and may appear legitimate by generating valid Sigstore provenance attestations.VercelIt primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms.VS CodePersistence via VS Code and Claude Code

Related Articles