Mini Shai-Hulud Supply-Chain Attack Compromised npm, PyPI, and Composer Packages

Researchers reported that the Mini Shai-Hulud campaign compromised widely used developer packages across npm, PyPI, and Packagist/Composer, including SAP CAP components, intercom-client, intercom/intercom-php, and PyTorch Lightning’s lightning package. The malicious releases delivered an obfuscated credential stealer executed with the Bun runtime, harvesting secrets from developer workstations and CI/CD environments, including GitHub, npm, cloud, Kubernetes, and AI tooling credentials. Stolen data was encrypted and exfiltrated through attacker-created public GitHub repositories, and the campaign was linked by multiple researchers to TeamPCP. Reports estimated exposure ranging from more than 1,000 to roughly 1,800 repositories, with no CVE, GHSA, or OSV identifiers assigned at disclosure.

Investigators said the attackers abused software publishing workflows rather than relying solely on direct maintainer compromise, including a stolen npm token tied to SAP’s cloudmtabot account, an exposed token in CircleCI pull-request builds, and overly broad GitHub and npm OIDC trusted publishing policies. The malware propagated by using stolen npm tokens to publish infected patch versions of additional packages and established persistence through developer tooling by planting .vscode/tasks.json entries with "runOn": "folderOpen" and .claude/settings.json SessionStart hooks, a technique compared to the earlier PolinRider/TasksJacker tradecraft. Maintainers released cleaned package versions, while defenders were urged to rotate credentials, review GitHub, npm, and cloud activity, harden OIDC publishing rules, pin dependencies, and hunt repositories for unauthorized folderOpen tasks and Claude hooks.