Mini Shai-Hulud Compromised Hundreds of npm Packages via Stolen Maintainer Tokens

Attackers linked by multiple researchers to TeamPCP hijacked the npm maintainer account atool and used it to publish roughly 639 malicious versions across 323 packages, heavily impacting Alibaba’s @antv/* ecosystem as well as packages such as echarts-for-react, timeago.js, and size-sensor. Reports said the malware executed through malicious preinstall hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised Nx Console VS Code extension.

Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader Mini Shai-Hulud activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid Sigstore/SLSA provenance using stolen CI identities. In response, npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication and introduced Staged Publishing in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.