Loading story…
Attackers abused the npm account atool—linked to the maintainer of timeago.js and with publish rights across Alibaba’s AntV ecosystem—to push malicious releases into widely used JavaScript packages. Reporting from StepSecurity, SafeDep, Aikido Security, and CSO indicates the campaign affected packages including timeago.js, echarts-for-react, size-sensor, and numerous @antv/* libraries used for charting, graphing, rendering, mapping, and spreadsheet functions in web applications and dashboards.
Researchers said the attacker published malicious code at scale, with one account citing 637 malicious versions across 317 packages in about 22 minutes, while another identified 143 compromised packages with affected versions. The payload was described as a CI/CD credential stealer and linked by some researchers to the Mini-Shai-Hulud worm, raising concern because the infected packages are commonly pulled into front-end builds and automated pipelines such as GitHub Actions, GitLab CI, and Kubernetes-hosted CI systems, where exposed tokens and cloud credentials could enable broader downstream compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
In response to the Mini-Shai-Hulud npm supply-chain campaign, GitHub removed 640 malicious packages from npm and invalidated 61,274 npm granular access tokens that had write permissions and 2FA bypass enabled. The action was part of containment after the compromised @antv ecosystem packages were found distributing credential-stealing malware.
Wiz reported that the TeamPCP-linked supply-chain campaign also compromised the GitHub Action actions-cool/issues-helper and the VSCode extension nrwl.angular-console version 18.95.0, extending the operation beyond malicious npm packages. The report also described a persistent Python backdoor that polled GitHub for signed commands containing the trigger string "firedalazer."
OX Security reported that the renewed Shai-Hulud npm supply-chain campaign was likely linked to TeamPCP and described the operation as financially motivated. The assessment was based in part on alleged social-media posts tied to the group, adding a new attribution angle to the incident.
Endor Labs reported that the May 19 Mini Shai-Hulud npm campaign could generate apparently legitimate Sigstore provenance by minting OIDC tokens, obtaining Fulcio certificates, and creating Rekor log entries. The finding showed that malicious packages in the AntV-related supply-chain attack could appear properly signed, undermining provenance-only trust decisions.
Security firms including SafeDep, Aikido Security, and StepSecurity said the malicious npm releases delivered the Mini-Shai-Hulud worm or a CI/CD credential stealer. The malware was described as targeting high-value build and cloud environments such as GitHub Actions, GitLab CI, and Kubernetes-hosted pipelines.
OpenSourceMalware reported that the May 19 npm supply-chain campaign affected not only the atool maintainer account but also the npm account "prop," with 324 packages republished as 645 package-version artifacts across two clustered publish waves. The report said the affected packages represented more than 16 million weekly downloads and highlighted broad downstream risk to developer and CI/CD environments.
Researchers reported that malicious releases affected timeago.js, echarts-for-react, size-sensor, @antv/scale, and a broad set of Alibaba AntV packages. StepSecurity said 143 packages were compromised and listed affected versions, indicating broad downstream exposure in front-end builds and CI/CD environments.
An attacker used the compromised npm account "atool" (i@hust.cc), which had publish rights across timeago.js and many AntV-related packages, to push malicious code at scale. SafeDep reported at least 637 malicious versions across 317 packages were published within a 22-minute window.
The source code for the Mini-Shai-Hulud npm malware was reportedly briefly exposed on GitHub, enabling other criminals to reuse it in later supply-chain attacks.
TrustedSec reported that credentials harvested by the Shai-Hulud/Mini-Shai-Hulud npm malware were actively abused, with more than 2,200 public GitHub repositories created using stolen tokens and named with Dune-themed terminology. The report also detailed persistence via Node.js preload backdoors in VS Code and Claude Code configurations and exfiltration through the GitHub API and t.m-kosche.com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
14 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesafedep.io
Open sourcemicrosoft.com
Open sourceopensourcemalware.com
Open sourcetrustedsec.com
Open sourcesecurity.snyk.io
Open sourcesecurity.snyk.io
Open sourcesecurity.snyk.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026
Attackers behind **Shai-Hulud** compromised the maintainer of the widely used npm library **`keyv`** and used a self-propagating worm dubbed **CHAINDROP** to trojanize the `keyv` monorepo and spread malicious updates across more than **400 npm packages**. The campaign abused npm **`preinstall`** hooks for code execution, stole developer credentials from infected machines, and automatically republished malicious package versions anywhere stolen npm tokens had write access, including cases where the tokens bypassed **2FA** protections. Packages tied to the `keyv` ecosystem, including **`flat-cache`**, **`cacheable-request`**, **`cacheable`**, and **`cache-manager`**, were identified as part of the downstream exposure, raising broad risk across JavaScript build pipelines and dependent applications. The malware expanded beyond package tampering by implanting **Claude Code** and **VS Code** execution hooks and harvesting secrets tied to AI tooling, cloud environments, GitHub, Kubernetes, Vault, SSH, and npm accounts. Elastic Security Labs reported that the operators used an **Ethereum smart contract** with fallback mechanisms to dynamically resolve exfiltration infrastructure, underscoring a more resilient and automated supply-chain tradecraft. Published guidance urged organizations to revoke GitHub and npm tokens, review repositories for suspicious commits attributed to **"claude"**, rotate exposed secrets, enable npm 2FA, and upgrade to **npm 12+** as defenders assess the blast radius of one of the largest recent npm ecosystem compromises.
Aug 12, 2026
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026