Compromised Intercom npm Package Steals GitHub Credentials Using Shai-Hulud-Style Attack
Summary
Intercom TypeScript Library version 7.0.4 runs an install-time infostealer that harvests GitHub credentials and retrieves C2 instructions through GitHub commit search. Users are advised to check for suspicious activity and rotate credentials.
Key points
- Version 7.0.4 runs setup.mjs through a preinstall hook, downloads the Bun runtime, and executes a payload.
- The payload runs `gh auth token` to steal GitHub credentials.
- It queries zero.masscan.cloud and uses GitHub's public commit-search API to retrieve C2 instructions embedded in commit messages.
- The malware deletes the downloaded Bun binary after execution to reduce forensic traces.
- The article says stolen credentials may be used to infect additional npm packages, as in previous Shai-Hulud-style attacks.
- Users who installed version 7.0.4 should check for suspicious activity and rotate GitHub credentials.
Article Details
- Attack Vectors
- Compromised Intercom TypeScript Library version 7.0.4 runs setup.mjs through a preinstall hook, downloads the Bun runtime, and executes a JavaScript payload that harvests GitHub credentials.
- The payload uses GitHub's public commit search API and a repository's public commit messages as a dead-drop resolver for C2 instructions.
- Stolen GitHub credentials are used to infect additional npm packages.
- Defensive Notes
- Users who installed version 7.0.4 should check for suspicious activity and rotate their GitHub credentials.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | zero[.]masscan[.]cloud | C2 domain queried by the payload. |
| URL | hxxps[:]//api[.]github[.]com/search/commits?q=beautifulcastle%20&sort=author-date&order=desc | GitHub commit-search query used as a dead-drop resolver to retrieve C2 instructions. |
| URL | hxxps[:]//api[.]github[.]com/search/commits?q=EveryBoiWeBuildIsAWormyBoi&sort=author-date&order=desc&per_page=50 | GitHub commit-search query used as a dead-drop resolver to retrieve C2 instructions. |
| URL | hxxps[:]//github[.]com/LuisDepo/sayyadina-heighliner-138 | Repository whose public commit messages are used to retrieve C2 instructions. |
MITRE ATT&CK
T1059.007 · JavaScriptThe package's preinstall hook runs setup.mjs, which executes the router_runtime.js payload.T1102.001 · Dead Drop ResolverThe payload queries GitHub commit search and a repository's public commit messages as a dead-drop resolver for C2 instructions.T1105 · Ingress Tool TransferThe setup script downloads the Bun runtime from GitHub before executing the payload.T1195.002 · Compromise Software Supply ChainThe compromised npm package is used to distribute the credential-stealing payload, and stolen credentials are used to infect additional packages.T1528 · Steal Application Access TokenThe payload runs gh auth token to harvest GitHub credentials.
Products
GitHubThe Intercom TypeScript Library [email protected] (published at 2026-04-30 at 14:41:04.098Z) has been compromised and uses a classic drop-and-execute attack pattern to run an infostealer that harvests GitHub Credentials.Intercom TypeScript LibraryThe Intercom TypeScript Library [email protected] (published at 2026-04-30 at 14:41:04.098Z) has been compromised and uses a classic drop-and-execute attack pattern to run an infostealer that harvests GitHub Credentials.