Listen to this Post
Introduction
A sophisticated npm supply chain campaign dubbed Mini Shai-Hulud has claimed 639 compromised package versions across 323 unique packages in a single hour on May 19, 2026. The bulk of the activity targeted the @antv ecosystem, alongside packages under @lint-md, @openclaw-cn, and @starmind scopes. The malware executes immediately upon installation via a `preinstall` lifecycle hook, harvesting GitHub tokens, npm tokens, AWS credentials, Kubernetes secrets, and database connection strings before exfiltrating them through AES-256-GCM encrypted channels to attacker-controlled infrastructure.
Learning Objectives
- Objective 1: Understand the mechanics of the Mini Shai-Hulud supply chain worm and its self-propagation capabilities across the npm ecosystem
- Objective 2: Learn to detect compromised packages using package-lock.json audits,
npm audit, and `socket` CLI scanning tools - Objective 3: Implement mitigation strategies including
--ignore-scripts, credential rotation, OS‑level backdoor removal, and CI/CD pipeline hardening
You Should Know
1. Malicious Payload Structure and Obfuscation Techniques
The injected payload is heavily obfuscated and operates at install time via a `preinstall` lifecycle hook:
"preinstall": "bun run index.js"
The attacker calls `bun run` rather than `node` to sidestep script-scanning tools that monitor Node.js invocations.
Technical Analysis of Obfuscation Layers:
- String table with custom base64: A 1,728-entry string table with hex-encoded variable names uses a custom base64 alphabet (lowercase before uppercase) to conceal malicious routines
- PBKDF2-SHA256 encryption: Configuration values including C2 domains and environment variables are encrypted using 200,000 iterations of PBKDF2-SHA256 with 32-byte output
- Fisher-Yates substitution cipher: A custom cipher built on shuffled permutation tables is applied in three rounds to further obscure payload behavior
Payload Execution Flow:
npm install → preinstall hook → bun run index.js → fork detached child process → scan for secrets → encrypt with AES-256-GCM → exfiltrate to C2
Linux/macOS Command to Inspect Package Scripts Before Installation:
Extract tarball without executing scripts npm pack @antv/g2 --dry-run tar -xzf .tgz cat package/package.json | grep -E "(preinstall|postinstall|install)"
2. Compromised Account Propagation and Sigstore Badge Forgery
The attack began with the compromise of the `atool` npm maintainer account, which maintained 547 packages. In two automated bursts (01:39–01:56 UTC and 02:05–02:06 UTC), attackers published malicious versions across 323 packages.
NOVEL BEHAVIOR: Sigstore Provenance Forgery
The worm now calls Fulcio and Rekor at runtime to submit valid Sigstore signing certificates and transparency log entries for every package it propagates. Provenance tooling displays a green badge despite the build chain being attacker-controlled.
Why This Matters: Developers relying on Sigstore provenance badges for security verification are now vulnerable to false positives, as the malware can forge valid signatures without compromising the legitimate build infrastructure.
Windows Command to Verify Package Signatures (Requires sigstore CLI):
Install sigstore CLI go install github.com/sigstore/cosign/v2/cmd/cosign@latest Verify npm package provenance cosign verify --key https://rekor.sigstore.dev/api/v1/log/entry?entry=12345 Check if package has valid Sigstore entry npm view @antv/g2 --json | findstr "sigstore"
3. Credential Harvesting Scope and Exfiltration Channels
The payload aggressively targets developer and CI/CD environments, harvesting credentials from over 130 file paths covering major cloud providers, development tools, and cryptocurrency wallets.
Complete List of Targeted Credentials:
| Category | Specific Items |
|-|-|
| Version Control | GitHub tokens, npm tokens, GitLab tokens |
| Cloud Providers | AWS keys (AWS_ACCESS_KEY_ID, SECRET_ACCESS_KEY, SESSION_TOKEN), Azure credentials, GCP service accounts |
| Infrastructure | Kubernetes kubeconfig, Vault tokens, Docker auth files |
| Databases | Connection strings (PostgreSQL, MongoDB, MySQL, Redis) |
| Development | SSH private keys, Claude Code settings, VS Code secrets |
Exfiltration Channels (Redundant Design):
- Primary: HTTPS POST to `https://t[.]m-kosche[.]com:443/api/public/otel/v1/traces`
- Fallback: Public GitHub repositories created under the victim’s own account with Dune‑themed names (
sayyadina-stillsuit-852) - Secondary Backup: Session messenger peer‑to‑peer network to complicate takedown efforts
Data Protection Before Transmission:
- Serialization → Gzip compression → AES-256-GCM encryption → RSA‑OAEP wrapped AES key → Transmission
Command to Detect Suspicious GitHub Repository Creation (Linux/macOS):
Check for attacker-created repositories under your account
gh api user/repos --jq '.[] | select(.description | contains("Shai-Hulud")) | .name'
Monitor for outbound connections to known C2 domains
sudo tcpdump -i any -n dst host t.m-kosche.com or dst port 443
4. OS‑Level Persistence and Backdoor Mechanisms
⚠️ CRITICAL: Removing the npm package does NOT remove the attacker’s foothold.
The malware establishes persistence through multiple layers:
Systemd User Service (Linux):
~/.config/systemd/user/kitty-monitor.service [bash] ExecStart=/usr/bin/node /home/user/.cache/kitty-monitor/index.js Restart=always
The kitty-monitor backdoor polls GitHub’s commit search every hour for signed remote commands, enabling attackers to maintain C2 access.
LaunchAgent (macOS):
<!-- ~/Library/LaunchAgents/com.apple.kitty-monitor.plist --> <dict> <key>ProgramArguments</key> <array><string>/usr/bin/node</string><string>/Users/user/.cache/kitty-monitor/index.js</string></array> <key>RunAtLoad</key><true/> </dict>
Developer Tool Backdoors:
– `.vscode/tasks.json` – Executes malicious tasks when VS Code opens the project
– `.claude/settings.json` – Injects commands into Claude Code AI coding assistant
Token Revocation Monitoring: A second process, gh-token-monitor, checks stolen GitHub tokens every 60 seconds, alerting the attacker the moment one is revoked.
Linux Command to Detect Persistence Artifacts:
Check for systemd user services with suspicious names
systemctl --user list-unit-files | grep -E "(kitty|monitor|gh-token)"
Audit VS Code tasks for malicious commands
find ~/ -name "tasks.json" -exec grep -l "preinstall|curl|wget|bun" {} \;
Check Claude Code settings
cat ~/.claude/settings.json 2>/dev/null | jq '.hooks'
Windows Command to Check for Suspicious Scheduled Tasks:
List all scheduled tasks with suspicious names
Get-ScheduledTask | Where-Object {$_.TaskName -match "kitty|monitor|gh-token"} | Format-List
Check npm global modules for malicious scripts
npm list -g --depth=0
5. CI/CD Pipeline Compromise and Self‑Propagation
The worm contains explicit logic for 18+ CI/CD platforms:
- GitHub Actions, GitLab CI, CircleCI, Jenkins, Azure DevOps
- AWS CodeBuild, Vercel, Netlify, Cloudflare Pages
Attack Chain in CI/CD Environments:
- Malicious package installs during `npm ci` in pipeline
- Payload reads GitHub Actions runner process memory to extract masked CI/CD secrets in plaintext
- Stolen tokens are used to enumerate maintainable packages via npm registry APIs
- Worm downloads package tarballs, injects malicious payload, adds `preinstall` hook, bumps version numbers
5. Republishes modified packages under compromised maintainer’s identity
GitHub Actions `pull_request_target` Exploitation (Pwn Request Pattern):
- Attackers chain `pull_request_target` workflow triggers to steal OIDC tokens
- CI cache poisoning across fork‑to‑base trust boundaries enables token extraction from runner process memory
Hardening Commands for GitHub Actions:
Restrict GITHUB_TOKEN permissions permissions: contents: read packages: read id-token: none Disable OIDC if not required Use immutable action versions - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 SHA pin Scan dependencies before install - name: Scan for malicious npm packages run: | npm install --package-lock-only --ignore-scripts npx socket security-check
6. Immediate Response and Mitigation Procedures
If you installed ANY affected package on May 19, 2026, treat ALL credentials on that machine as compromised and rotate immediately.
Step‑by‑Step Response Plan:
Step 1: Identify Compromised Package Versions
List affected packages in your project
npm ls @antv/g2 @antv/g6 @antv/x6 @antv/l7 echarts-for-react timeago.js size-sensor canvas-nest.js
Check package-lock.json for malicious versions (vulnerable range: May 19, 2026 publishes)
grep -E '("version": "..[0-9]+.[0-9]+")' package-lock.json | grep -v "pre-May 19"
Step 2: Pin to Safe Versions (pre‑May 19)
// package.json
{
"dependencies": {
"@antv/g2": "5.1.20", // Pin to last known good version
"echarts-for-react": "3.0.2"
},
"overrides": {
"@antv/g2": "5.1.20"
}
}
Step 3: Reinstall with Scripts Disabled
Remove node_modules and lockfile rm -rf node_modules package-lock.json Install WITHOUT executing preinstall hooks npm install --ignore-scripts For CI/CD pipelines npm ci --ignore-scripts
Step 4: Rotate ALL Exposed Credentials
- GitHub tokens (revoke and regenerate in Settings → Developer settings)
- npm tokens (delete and recreate in npm profile)
- AWS keys (rotate via IAM console or CLI)
- Kubernetes service account tokens
- SSH keys (generate new key pairs)
- Database connection strings (rotate passwords)
- VS Code and Claude Code settings tokens
Step 5: Remove Persistence Artifacts
Remove systemd user services (Linux) systemctl --user stop kitty-monitor gh-token-monitor systemctl --user disable kitty-monitor gh-token-monitor rm -f ~/.config/systemd/user/kitty-monitor.service rm -f ~/.config/systemd/user/gh-token-monitor.service Remove LaunchAgents (macOS) launchctl unload ~/Library/LaunchAgents/com.apple.kitty-monitor.plist rm -f ~/Library/LaunchAgents/com.apple.kitty-monitor.plist Clean developer tool backdoors sed -i '/malicious-command/d' .vscode/tasks.json sed -i '/evil-hook/d' .claude/settings.json Clear cache directory rm -rf ~/.cache/kitty-monitor ~/.cache/gh-token-monitor
What Undercode Say
- Key Takeaway 1: Supply chain attacks have evolved beyond simple credential theft. The Mini Shai-Hulud worm demonstrates self‑propagation, OS‑level persistence, Sigstore signature forgery, and multi‑channel exfiltration—making it one of the most sophisticated npm campaigns to date. Standard response procedures (removing the package) are completely inadequate.
- Key Takeaway 2: Trust no package—even with valid Sigstore badges. The ability to forge Sigstore provenance signatures breaks a fundamental assumption of package security tooling. Organizations must implement runtime monitoring for malicious behavior rather than relying solely on static provenance verification.
Analysis: The Mini Shai-Hulud campaign represents a paradigm shift in software supply chain attacks. By compromising a single maintainer account (atool), attackers achieved a blast radius of approximately 16 million weekly downloads. The worm’s Russian language check (payload terminates if system language is Russian) suggests geopolitical targeting. The public release of the malware’s open-source version means automated worms will proliferate across PyPI, Composer, and npm simultaneously. Organizations still using auto‑dependency updates without script isolation remain critically exposed.
Prediction
The Mini Shai-Hulud attack pattern will become the blueprint for future supply chain worms across all major package registries. Expect cross‑ecosystem propagation (npm → PyPI → RubyGems → Maven Central) using stolen tokens from CI/CD pipelines. The Sigstore forgery technique will likely be weaponized to target provenance‑verified package repositories, eroding trust in software bill of materials (SBOM) tooling. By Q3 2026, anticipate AI‑powered version selection algorithms that automatically identify dormant maintainer accounts with high‑download packages, enabling attackers to compromise hundreds of packages in under five minutes without human intervention.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Cybersecuritynews Share – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
