StepSecurity Details Mini Shai-Hulud Attack on AntV npm Ecosystem

Summary

StepSecurity details a Mini Shai-Hulud campaign that it says poisoned npm packages across AntV and related projects, stealing CI/CD credentials. Its analysis traces package-install execution, credential theft and exfiltration, persistence, and runner defenses.

Key points

StepSecurity reports malicious versions across the AntV ecosystem and related npm packages, published through the compromised atool account; its article lists affected package versions.
The payload can read GitHub Actions Runner.Worker memory to extract masked secrets and searches more than 130 file-path patterns for cloud, developer, Kubernetes, and other credentials.
Malicious package-install hooks or a poisoned optional dependency can launch the payload through Bun; it also installs persistence in Claude Code and VS Code configurations and can add a GitHub Actions workflow.
StepSecurity's runtime analysis observed attempted exfiltration through a GitHub API dead drop and t[.]m-kosche[.]com, disguised as an OpenTelemetry endpoint.
StepSecurity reports that more than 2,500 public repositories bearing the campaign marker had been created using stolen GitHub tokens.
In StepSecurity's Harden-Runner test, default controls blocked the C2 connection and detected runner-memory reads, providing two independent points of interruption.
The article advises checking dependency lockfiles and CI logs, removing persistence artifacts, and rotating credentials accessible to environments that installed affected versions.

Article Details

Attack Vectors: The attackers used the compromised npm account atool to publish malicious versions of packages, including packages in the @antv namespace.
Malicious preinstall or postinstall hooks execute the payload during package installation. In another delivery pattern, an optional dependency points to a poisoned commit in antvis/G2 whose prepare hook runs the payload.
The payload reads GitHub Actions runner memory and harvests credentials from environment variables and credential files.
Stolen data is exfiltrated either to a dead-drop branch in antvis/G2 through the GitHub API or over HTTPS to t.m-kosche.com.
The payload installs persistence hooks in Claude Code and VS Code configurations and injects a GitHub Actions workflow.
The payload attempts privilege escalation by writing a passwordless sudoers rule on Linux CI runners.
Defensive Notes: If a compromised package version was installed, treat secrets accessible in that environment as compromised and rotate them, including GitHub, npm, cloud, SSH, and other credentials.
Check lockfiles and dependency trees against the article's compromised package versions; pin affected packages to safe versions, remove node_modules, and reinstall.
Check for injected files and configuration changes, including .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, .vscode/setup.mjs, and .github/workflows/codeql.yml.
Review CI logs and process telemetry for @antv/setup, bun run index.js, and processes reading /proc/*/mem; review network logs for t.m-kosche.com and suspicious GitHub API activity.
Audit repositories for unauthorized commits, branches, repositories, or workflow changes, and review and revoke unrecognized npm access tokens.
Use network egress controls and package cooldown or compromised-package checks to reduce the risk of payload execution and exfiltration.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`t[.]m-kosche[.]com`	Attacker-controlled fallback C2 domain used to exfiltrate encrypted stolen data over HTTPS.
SHA1	`7cb42f57561c321ecb09b4552802ae0ac55b3a7a`	Poisoned antvis/G2 commit referenced by an optional dependency to trigger the malicious prepare hook.