Mini Shai-Hulud Worm Resurfaces Across Hundreds of npm Packages
Summary
Researchers report that the TeamPCP-linked Mini Shai-Hulud worm is spreading through hundreds of npm packages, stealing credentials, poisoning accessible packages and planting persistent backdoors that can remain after package removal.
Key points
- The campaign is reported to be active, with Mini Shai-Hulud spreading through hundreds of npm packages.
- The malware runs when an affected package is installed, including in developer environments and CI/CD pipelines, and steals GitHub, npm, SSH, cloud and database credentials.
- Using stolen publishing tokens, it can inject code into accessible packages and publish poisoned versions under a maintainer’s account.
- Backdoors in .vscode/tasks.json and .claude/settings.json can persist after the infected package is removed.
- The malware reportedly installs Linux systemd user services or macOS LaunchAgents; kitty-monitor polls GitHub commit search hourly, while gh-token-monitor checks stolen tokens every 60 seconds.
- Packages named in this wave include AntV, TallyUI, echarts-for-react and timeago.js.
- Researchers advise treating machines and runners that installed affected versions as exposed, rotating secrets, removing persistence artifacts and reviewing recent publishing activity.
Article Details
- Attack Vectors
- Compromised npm packages execute malware when installed, including in developers’ local environments and CI/CD pipelines.
- The malware uses stolen publishing tokens to add itself to packages the token can access and publish poisoned versions under the legitimate maintainer’s account.
- The malware searches developers’ computers for other Node.js projects and copies itself into them.
- The malware harvests GitHub and npm tokens, SSH keys, cloud credentials, and database connection strings, then sends stolen data to attacker-controlled GitHub repositories.
- The malware installs persistent backdoors in .vscode/tasks.json and .claude/settings.json and creates OS-level background services: a systemd user service on Linux and a LaunchAgent on macOS.
- The kitty-monitor backdoor polls GitHub commit search hourly for signed remote commands; gh-token-monitor checks stolen GitHub tokens every 60 seconds.
- Defensive Notes
- Treat any machine or CI/CD runner that installed an affected package version as compromised until secrets are rotated, persistence artifacts are removed, and recent publishing activity is reviewed.
- Audit and clean .vscode/tasks.json and .claude/settings.json; removing the affected npm package alone does not remove the backdoors.
- Review and remove the malicious systemd user service or macOS LaunchAgent, and rotate potentially exposed credentials.
MITRE ATT&CK
T1078 · Valid AccountsUsing stolen tokens, the malware publishes poisoned versions through the legitimate maintainer’s account.T1102.002 · Bidirectional CommunicationThe kitty-monitor backdoor polls GitHub commit search for signed remote commands.T1195.001 · Compromise Software Dependencies and Development ToolsTeamPCP spread poisoned npm package releases, including by adding malware to packages accessible with stolen publishing tokens.T1528 · Steal Application Access TokenMini Shai-Hulud steals GitHub and npm access tokens from infected environments.T1543.001 · Launch AgentThe malware installs a LaunchAgent on macOS to run the kitty-monitor backdoor.T1543.002 · Systemd ServiceThe malware installs a systemd user service on Linux to run the kitty-monitor backdoor.T1550.001 · Application Access TokenThe malware uses stolen publishing tokens to publish poisoned package versions under a legitimate maintainer’s account.T1567.001 · Exfiltration to Code RepositoryStolen data is sent to attacker-controlled GitHub repositories.
Threat Actors
Malware
Products
AntV#MiniShaiHuludecharts-for-reactAffected packages include AntV, TallyUI, echarts-for-react, and timeago.js.GitHubThe malware steals GitHub, npm, SSH, cloud, and database credentials.MistralAI#MiniShaiHuludnpmMini Shai-Hulud has resurfaced as a self-replicating worm inside hundreds of npm packages, with TeamPCP using stolen tokens and CI/CD access to spread poisoned releases and persist on infected systems.TallyUI#MiniShaiHuludTanStack#MiniShaiHuludtimeago.jsAffected packages include AntV, TallyUI, echarts-for-react, and timeago.js.UiPath#MiniShaiHulud