Mini Shai Hulud Supply-Chain Campaign Expands to PyPI and npm Packages
Summary
Kudelski Security reports that the TeamPCP-attributed Mini Shai Hulud campaign compromised npm and PyPI packages to steal developer and CI/CD credentials, with propagation through maintainer accounts and automated workflows.
Key points
- The report attributes the campaign to TeamPCP and lists compromised SAP-related npm packages, PyPI lightning versions 2.6.2 and 2.6.3, and npm intercom-client 7.0.4.
- Malicious install scripts download the Bun runtime and execute obfuscated payloads; the lightning package also runs a Python script on import.
- The malware targets GitHub and npm credentials, cloud secrets, Kubernetes tokens, CI/CD secrets, and browser credentials.
- Stolen data is reportedly exfiltrated through attacker-controlled public GitHub repositories using encrypted payloads.
- The campaign can modify local npm packages, add a postinstall hook, and repack them, enabling further spread if tampered packages are published.
- The report recommends blocking and removing affected versions, rotating potentially exposed credentials, auditing GitHub activity, and checking for listed file hashes and malicious files.
- Kudelski Security says its Cyber Fusion Center is monitoring the activity and plans a threat-hunting campaign.
Article Details
- Attack Vectors
- Compromised npm and PyPI packages execute malicious preinstall, postinstall, or import-triggered scripts that download the Bun runtime and run obfuscated JavaScript payloads.
- The payload steals developer and CI/CD credentials, including GitHub and npm tokens, cloud secrets, Kubernetes tokens, GitHub Actions secrets, and browser credentials.
- Stolen data is encrypted and exfiltrated through attacker-controlled public GitHub repositories.
- The malware propagates by modifying local npm packages, adding a postinstall hook, incrementing package versions, and repacking tarballs for potential downstream publication.
- Defensive Notes
- Search environments, lockfiles, artifact stores, and CI logs for the affected package versions and the files setup.mjs and execution.js.
- Rotate potentially exposed GitHub, npm, cloud, Kubernetes, and CI/CD credentials.
- Audit GitHub activity for suspicious commits, newly created repositories, the propagation keyword, and unusual commit authors.
- Block and remove lightning 2.6.2 and 2.6.3 and intercom-client 7.0.4; the article identifies lightning 2.6.1 and intercom-client 7.0.3 as clean releases at the time of writing.
- Use the listed file hashes to detect compromised files, and enforce branch protection, pull-request reviews, status checks, and commit signature verification.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 04d8a99447b16f6839fff3b978f88d7e | MD5 hash listed for the compromised mbt tarball. |
| MD5 | 35baf8316645372eea40b91d48acb067 | MD5 hash listed for the shared dropper file setup.mjs. |
| MD5 | 40d0f21b64ec8fb3a7a1959897252e09 | MD5 hash listed for the lightning execution payload router_runtime.js. |
| MD5 | 45dc9c02f82b4370ca92785282d43a86 | MD5 hash listed for the execution.js payload associated with mbt. |
| MD5 | 598f8a39b021cf56d33432b6f67f7660 | MD5 hash listed for the intercom-client dropper file setup.mjs. |
| MD5 | 6fb87d243b011b5445f379f80e1a6b4d | MD5 hash listed for the execution.js payload associated with db-service. |
| MD5 | 8cd683f78735c9bfc32600c73d3d9abe | MD5 hash listed for the compromised @cap-js/db-service tarball. |
| MD5 | 9bd71891febd47b6a7d9ef1f6120662a | MD5 hash listed for the intercom-client execution payload router_runtime.js. |
| MD5 | b523a69b27064d1715d1f0aaffcfae63 | MD5 hash listed for the execution.js payload associated with the sqlite/postgres packages. |
| MD5 | e32eaf0c3cde9616831a1e92d42b0058 | MD5 hash listed for the compromised @cap-js/sqlite and @cap-js/postgres tarball. |
| SHA1 | 0af7415d65753f6aede8c9c0f39be478666b9c12 | SHA-1 hash listed for the compromised mbt tarball. |
| SHA1 | 0cf67457352cf82dea4189d9dbd41b8f519dbb81 | SHA-1 hash listed for the intercom-client execution payload router_runtime.js. |
| SHA1 | 307d0fa7407d40e67d14e9d5a4c61ac5b4f20431 | SHA-1 hash listed for the shared dropper file setup.mjs. |
| SHA1 | 6bc859aaee1f8885eec2a3016226e877e5adba08 | SHA-1 hash listed for the execution.js payload associated with mbt. |
| SHA1 | 7b6a28e92149637e5d7c7f4a2d3e54acd507c929 | SHA-1 hash listed for the compromised @cap-js/db-service tarball. |
| SHA1 | 7c8bf63a9ba9169d5237acfc683f1bd004349341 | SHA-1 hash listed for the intercom-client dropper file setup.mjs. |
| SHA1 | bc95cc5dda788295aa0c9456791520599ef99526 | SHA-1 hash listed for the execution.js payload associated with db-service. |
| SHA1 | ca4a5bb85778ffcd2153ace88fe2d882c8ceeb23 | SHA-1 hash listed for the execution.js payload associated with the sqlite/postgres packages. |
| SHA1 | e80824a19f48d778a746571bb15279b5679fd61c | SHA-1 hash listed for the compromised @cap-js/sqlite and @cap-js/postgres tarball. |
| SHA1 | f1b3e7b3eec3294c4d6b5f87854a52471f03997f | SHA-1 hash listed for the lightning execution payload router_runtime.js. |
| SHA256 | 1d9e4ece8e13c8eaf94cb858470d1bd8f81bb58f62583552303774fa1579edee | SHA-256 hash listed for the compromised @cap-js/sqlite and @cap-js/postgres tarball. |
| SHA256 | 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34 | SHA-256 hash listed for the shared dropper file setup.mjs. |
| SHA256 | 5ae8b2343e97cc3b2c945ec34318b63f27fa2db1e3d8fbaa78c298aa63db52ed | SHA-256 hash listed for the intercom-client execution payload router_runtime.js. |
| SHA256 | 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1 | SHA-256 hash listed for the lightning execution payload router_runtime.js. |
| SHA256 | 6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95 | SHA-256 hash listed for the execution.js payload associated with db-service. |
| SHA256 | 80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac | SHA-256 hash listed for the execution.js payload associated with mbt. |
| SHA256 | 86282ebcd3bebf50f087f2c6b00c62caa667cdcb53558033d85acd39e3d88b41 | SHA-256 hash listed for the compromised mbt tarball. |
| SHA256 | a1da198bb4e883d077a0e13351bf2c3acdea10497152292e873d79d4f7420211 | SHA-256 hash listed for the compromised @cap-js/db-service tarball. |
| SHA256 | eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb | SHA-256 hash listed for the execution.js payload associated with the sqlite/postgres packages. |
| SHA256 | fe64699649591948d6f960705caac86fe99600bf76e3eae29b4517705a58f0e2 | SHA-256 hash listed for the intercom-client dropper file setup.mjs. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe payload propagates by injecting postinstall hooks into package.json files so they execute during package installation.T1059.007 · JavaScriptThe compromised packages run malicious JavaScript payloads through preinstall, postinstall, or import-triggered scripts.T1098 · Account ManipulationThe campaign reportedly uses compromised maintainer accounts to distribute malicious package versions.T1195.002 · Compromise Software Supply ChainMalicious scripts were injected into npm and PyPI packages distributed through package registries.T1552.001 · Credentials In FilesThe malware collects secrets including GitHub and npm tokens, cloud secrets, Kubernetes tokens, and GitHub Actions secrets.T1555.003 · Credentials from Web BrowsersThe payload is reported to steal credentials stored in Chrome, Safari, Edge, Brave, and Chromium.T1567.001 · Exfiltration to Code RepositoryThe article reports encrypted exfiltration through public GitHub repositories.
Threat Actors
Products
AWSCloud secrets (AWS, Azure, GCP)AzureCloud secrets (AWS, Azure, GCP)BraveThe attack also introduces browser credential theft capabilities, targeting multiple browsers such as Chrome, Safari, Edge, Brave, and Chromium.ChromiumThe attack also introduces browser credential theft capabilities, targeting multiple browsers such as Chrome, Safari, Edge, Brave, and Chromium.EdgeThe attack also introduces browser credential theft capabilities, targeting multiple browsers such as Chrome, Safari, Edge, Brave, and Chromium.GCPCloud secrets (AWS, Azure, GCP)GitHubpreinstall scripts. The attack aims to harvest developer and CI/CD secrets from platforms such as GitHub, npm, and major cloud providers, with exfiltration occurring via attacker-controlled GitHub repositories.Google ChromeThe attack also introduces browser credential theft capabilities, targeting multiple browsers such as Chrome, Safari, Edge, Brave, and Chromium.KubernetesKubernetes tokensnpmbeen attributed to the threat actor group TeamPCP. This operation involves the compromise of SAP-related npm packages through the injection of malicious preinstall scripts. The attack aims to harvest developer andPyPIcampaign has expanded beyond the initial SAP package ecosystem to compromise high-profile packages in the PyPI (lightning aka PyTorch Lightning) and npm (intercom-client) registries. The threat actors have shiftedSafariThe attack also introduces browser credential theft capabilities, targeting multiple browsers such as Chrome, Safari, Edge, Brave, and Chromium.