Step Security Reports Shai-Hulud Worm in Hijacked Intercom npm Package, Targeting Cloud Credentials

Apr 30, 2026 · Original article ↗

Summary

Step Security reports [email protected] was published with a Shai-Hulud payload that runs through a new preinstall hook, targets GitHub/npm and AWS, GCP and Azure credentials, and uses private GitHub repositories for exfiltration and npm tokens to propagate.

Key points

Step Security identifies [email protected], published April 30, 2026, as malicious and recommends version 7.0.3 as the safe version.
The reported package adds a preinstall hook and obfuscated router_runtime.js payload; its unpacked size increased from about 6 MB to 17.8 MB, and SLSA provenance attestations are absent.
The setup.mjs loader downloads Bun 1.3.13 to run the payload; the analysis also describes daemonization and temporary-file cleanup intended to hinder detection.
The payload reportedly searches for GitHub and npm tokens, AWS, GCP and Azure credentials, private keys, and other secrets in files and environment variables.
Step Security says the payload uses a stolen GitHub token to create a private repository for exfiltration and stolen npm tokens to propagate to packages the victim can publish.
Attribution to Shai-Hulud/TeamPCP is based on shared tooling and behaviors, including the Bun version, obfuscation cipher, daemonization method, and OIDC publishing pattern.
For affected installations, Step Security recommends downgrading, auditing CI/CD activity, rotating accessible credentials, and using install-script restrictions and exact version pins.

Article Details

Attack Vectors: The compromised [email protected] npm package runs a newly added preinstall hook, node setup.mjs, which downloads or reuses Bun and launches the obfuscated router_runtime.js payload.
The payload harvests GitHub and npm tokens, cloud credentials from AWS and GCP metadata endpoints, Azure credentials, private keys, and other secrets from configuration files and environment variables.
Using stolen GitHub credentials, the payload creates a private repository under the victim's account and commits encrypted harvested credentials and cloud metadata.
Stolen npm publish tokens are used to enumerate packages the token can publish, inject the worm's files and preinstall hook, and publish compromised package versions.
Defensive Notes: Remove [email protected], install the reported safe version [email protected] with --ignore-scripts, and check for setup.mjs and router_runtime.js in installed packages.
Rotate all secrets accessible to affected machines and CI/CD jobs, including GitHub and npm tokens, AWS credentials, GCP service account credentials, Azure secrets, and other environment secrets.
Audit CI/CD runs that installed the compromised package, npm publishing activity, newly created private GitHub repositories, and cloud audit logs for unexpected credential use.
Use npm ci --ignore-scripts as a CI/CD policy, pin exact dependency versions, and verify SLSA attestations for packages that support them.
Use step-level egress controls to block undeclared outbound connections during install steps; the article identifies unexpected GitHub API and cloud metadata requests as useful signals.

Indicators of compromise

Type	Indicator	Context
SHA1	`1a1b1d0d89fadf7664c42ec628bac7d39a71bd50`	npm shasum for the compromised [email protected] package.
SHA256	`5ae8b2343e97cc3b2c945ec34318b63f27fa2db1e3d8fbaa78c298aa63db52ed`	SHA-256 of router_runtime.js, the obfuscated credential-stealing payload.
SHA256	`5f748fbc89cde66abefa826439c765a0081a027792e9da8d80fbf23571311622`	Tarball SHA-256 for the compromised [email protected] package.
SHA256	`fe64699649591948d6f960705caac86fe99600bf76e3eae29b4517705a58f0e2`	SHA-256 of setup.mjs, the malicious package loader.
URL	`hxxps[:]//api[.]github[.]com/user`	GitHub API endpoint the payload uses with stolen credentials as part of exfiltration to a private repository under the victim's account.