Malicious intercom-client npm Release Targets Developer and CI/CD Credentials
Summary
The compromised intercom-client@7.0.4 npm release ran malicious code during installation to collect secrets from developer and CI/CD environments. Socket also links a compromised GitHub account to the package’s publication.
Key points
- The malicious intercom-client@7.0.4 release added setup.mjs and router_runtime.js, absent from the previous version.
- A preinstall hook downloaded and ran an unverified Bun binary, so exposure could occur even if the package was never imported by an application.
- The obfuscated payload targeted Kubernetes and Vault credentials in environment variables and local files, then encrypted and exfiltrated secrets through the GitHub API.
- Socket confirmed that a compromised GitHub account published the package through a deleted branch that triggered an automated CI publishing workflow.
- The article describes suspicious repository changes and workflows configured to access GitHub secrets and upload them as artifacts.
- Socket says the incident resembles other Mini Shai-Hulud-style supply-chain attacks but is still investigating whether it is part of the same campaign.
- Users are advised to remove version 7.0.4, downgrade to a known-good version, rotate potentially exposed credentials, and investigate systems where it was installed.
Article Details
- Victim Organization
- Intercom
- Incident Type
- Compromise of the intercom-client npm package through a malicious release and compromised GitHub account; the malicious code was designed to collect credentials and exfiltrate them.
- Data Types Exposed
- Kubernetes credentials
- Vault credentials and tokens
- Cloud credentials
- GitHub tokens
- Operational Impact
- Developers and CI/CD environments that installed intercom-client@7.0.4 may have been exposed during installation, even if they did not import or use the package. The article does not report confirmed service disruption or quantify affected systems.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 598f8a39b021cf56d33432b6f67f7660 | MD5 hash of the malicious setup.mjs file in intercom-client@7.0.4. |
| MD5 | 9bd71891febd47b6a7d9ef1f6120662a | MD5 hash of the malicious router_runtime.js file in intercom-client@7.0.4. |
| SHA1 | 0cf67457352cf82dea4189d9dbd41b8f519dbb81 | SHA-1 hash of the malicious router_runtime.js file in intercom-client@7.0.4. |
| SHA1 | 7c8bf63a9ba9169d5237acfc683f1bd004349341 | SHA-1 hash of the malicious setup.mjs file in intercom-client@7.0.4. |
| SHA256 | 5ae8b2343e97cc3b2c945ec34318b63f27fa2db1e3d8fbaa78c298aa63db52ed | SHA-256 hash of the malicious router_runtime.js file in intercom-client@7.0.4. |
| SHA256 | fe64699649591948d6f960705caac86fe99600bf76e3eae29b4517705a58f0e2 | SHA-256 hash of the malicious setup.mjs file in intercom-client@7.0.4. |
Threat Actors
Malware
Vendors
Products
Buna preinstall hook that runs setup.mjs during installation. The script downloads and executes an unverified Bun binary from GitHub without integrity checks. The second malicious file, router_runtime.js, is an 11.7 MBGitHubthat runs setup.mjs during installation. The script downloads and executes an unverified Bun binary from GitHub without integrity checks. The second malicious file, router_runtime.js, is an 11.7 MB heavily obfuscatedintercom-clientSocket AI scanner detected, and the Socket Threat Research team has confirmed that intercom-client@7.0.4 is malicious, identifying a fresh compromise of the npm package used for Intercom’s Node.js client.Kubernetesmalicious file, router_runtime.js, is an 11.7 MB heavily obfuscated JavaScript file designed to collect Kubernetes and Vault credentials from environment variables and local files. Stolen secrets are encrypted andnpmSocket AI scanner detected, and the Socket Threat Research team has confirmed that intercom-client@7.0.4 is malicious, identifying a fresh compromise of the npm package used for Intercom’s Node.js client.Vaultrouter_runtime.js, is an 11.7 MB heavily obfuscated JavaScript file designed to collect Kubernetes and Vault credentials from environment variables and local files. Stolen secrets are encrypted and exfiltrated