Mini Shai-Hulud Campaign Hits Hundreds of npm Packages, Including @antv
Summary
Researchers report 639 malicious releases across 323 npm packages, including @antv projects. The Mini Shai-Hulud payload steals credentials, propagates via stolen npm tokens, exfiltrates data, and abuses CI-issued Sigstore attestations.
Key points
- Researchers report 639 malicious versions across 323 packages, including 558 versions across 279 @antv packages; affected packages include echarts-for-react.
- The payload reportedly steals more than 20 types of credentials, including cloud, GitHub, npm, SSH, Kubernetes, and database credentials, and attempts escape via a Docker host socket.
- Stolen data is reportedly sent to t.m-kosche[.]com:443; as a fallback, the malware uses stolen GitHub tokens to create public repositories containing the data.
- The propagation logic uses stolen npm tokens to enumerate maintained packages, inject a preinstall hook, and republish trojanized versions.
- Researchers report that the malware abuses CI-issued OIDC tokens to obtain Sigstore certificates and create attestations that do not establish that a release was authorized.
- The campaign is assessed to be operated by TeamPCP; the article also reports copycat packages from an unknown actor after the campaign's source code was released.
- Users of affected packages are advised to switch to safe versions, rotate credentials, enable two-factor authentication, and audit GitHub for related indicators.
Article Details
- Attack Vectors
- Compromised npm maintainer accounts and stolen maintainer or CI/CD tokens were used to publish trojanized package versions.
- Malicious package versions ran a preinstall hook (`bun run index.js`) and propagated by validating stolen npm tokens, enumerating the token owner's packages, injecting payloads, and republishing them.
- The payload harvested credentials and exfiltrated collected data to an external server; it also used stolen GitHub tokens to create public repositories containing exfiltrated data.
- The campaign abused CI-issued OIDC tokens to create Sigstore attestations and forge SLSA provenance for malicious releases.
- The payload reportedly attempted Docker container escape via the host socket.
- Defensive Notes
- Rotate credentials that may have been exposed, including maintainer, GitHub, npm, cloud, SSH, and CI/CD credentials.
- Enable two-factor authentication and audit GitHub accounts for repositories containing the Shai-Hulud-related marker strings.
- Replace poisoned package versions with safe versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | t[.]m-kosche[.]com | Reported external server used to exfiltrate collected data. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign's malicious payload is described as obfuscated.T1059.007 · JavaScriptCompromised package versions added a preinstall hook that ran `bun run index.js`.T1195.002 · Compromise Software Supply ChainCompromised npm maintainer accounts were used to distribute trojanized versions of packages in the @antv ecosystem and related packages.T1550.001 · Application Access TokenStolen npm tokens were used to republish packages, and stolen GitHub tokens were used to create public repositories containing exfiltrated data.T1567.001 · Exfiltration to Code RepositoryThe malware used stolen GitHub tokens to place exfiltrated data in public repositories.T1611 · Escape to HostThe stealer reportedly attempted to escape Docker containers via the host socket.
Threat Actors
Malware
ChainDropResearchers uncovered a new Mini Shai-Hulud supply chain campaign that compromised numerous npm packages in the @antv ecosystem, including echarts-for-react, and used stolen maintainer and CI/CD tokens to pushShai-HuludResearchers uncovered a new Mini Shai-Hulud supply chain campaign that compromised numerous npm packages in the @antv ecosystem, including echarts-for-react, and used stolen maintainer and CI/CD tokens to push
Products
@antv/data-set@antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the @antv namespace, including echarts-for-react, timeago.js,@antv/f2of affected packages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the @antv@antv/gpackages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the @antv@antv/g2The list of affected packages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the@antv/g2plotinclude @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the @antv namespace, including@antv/g6The list of affected packages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the@antv/graphinpackages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the @antv namespace, including@antv/l7The list of affected packages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the@antv/s2The list of affected packages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside the@antv/x6The list of affected packages include @antv packages such as @antv/g2, @antv/g6, @antv/x6, @antv/l7, @antv/s2, @antv/f2, @antv/g, @antv/g2plot, @antv/graphin, and @antv/data-set, as well as related packages outside theApache ECharts“The attack affects packages tied to the npm maintainer account atool, including echarts-for-react, a widely used React wrapper for Apache ECharts with roughly 1.1 million weekly downloads,” Socket said.canvas-nest.jsrelated packages outside the @antv namespace, including echarts-for-react, timeago.js, size-sensor, canvas-nest.js, and others.echarts-for-reactsupply chain campaign that compromised numerous npm packages in the @antv ecosystem, including echarts-for-react, and used stolen maintainer and CI/CD tokens to push trojanized releases at scale.GitHubThe attack steals cloud, developer, and infrastructure credentials, exfiltrates data through GitHub and external servers, and is linked to TeamPCP and copycat malicious npm packages.npmResearchers uncovered a new Mini Shai-Hulud supply chain campaign that compromised numerous npm packages in the @antv ecosystem, including echarts-for-react, and used stolen maintainer and CI/CD tokens to pushSigstoreThe campaign includes propagation logic, Sigstore attestation abuse, and copycat npm packages.size-sensoras well as related packages outside the @antv namespace, including echarts-for-react, timeago.js, size-sensor, canvas-nest.js, and others.timeago.js@antv/data-set, as well as related packages outside the @antv namespace, including echarts-for-react, timeago.js, size-sensor, canvas-nest.js, and others.