Mini Shai-Hulud Attack Hits npm Ecosystem, Compromising Over 600 Packages

A large-scale supply chain attack targeting the npm ecosystem has resurfaced with a new variant of the Mini Shai-Hulud malware, compromising more than 600 packages and introducing advanced evasion techniques, including forged Sigstore provenance.

The attack primarily targeted the widely used @antv ecosystem but quickly spread to other popular libraries and developer tools.

The attack occurred within a narrow 27-minute window from 01:39 to 02:06 UTC. Initial compromise points included dormant packages such as jest-canvas-mock and size-sensor, both inactive for several years.

Threat actors leveraged these neglected packages to inject malicious code and begin lateral Propagation.

From there, the worm-like malware spread across dozens of @antv packages, including components used for data visualization, charting, and graph rendering. Additional affected packages include echarts-for-react, timeago.js, and several utilities under namespaces like @lint-md and @openclaw-cn.

Security researchers from Endor Labs and Socket identified the campaign on May 19, 2026, initially detecting 42 malicious packages, which rapidly expanded to at least 633 confirmed compromised versions across hundreds of packages.

Security firm Socket reported detecting 639 compromised versions across 323 unique packages, highlighting the scale and speed of the attack.

Mini Shai-Hulud Attack Compromising 600 npm Packages

One of the most significant developments in this campaign is the abuse of Sigstore, a widely trusted software supply chain security framework.

The malware dynamically generates valid signing certificates using Fulcio and records entries in Rekor transparency logs. As a result, infected packages display legitimate “verified” provenance badges, making them appear trustworthy to developers and automated security tools.

However, researchers emphasize that while the cryptographic signatures are valid, they do not guarantee that legitimate maintainers authorized the package. Instead, the attacker uses stolen credentials and CI/CD tokens to produce seemingly authentic builds.

The campaign uses two primary delivery techniques:

• Phantom dependency injection: Malicious code is executed via optionalDependencies referencing GitHub commits. These dependencies run a hidden payload during installation using npm lifecycle hooks, then fail silently, leaving no trace in node_modules.
• Embedded payload execution: Compromised packages include an obfuscated index.js file triggered via a preinstall script, ensuring execution before dependency resolution.

Example:

A package like @antv/l7-core included a 500KB obfuscated payload executed automatically during installation via:

"preinstall": "bun run index.js"

Credential Theft and Persistence

The payload is designed to harvest sensitive credentials from developer environments and CI/CD pipelines. Targets include:

• GitHub and npm tokens
• AWS credentials via IMDS endpoints
• Google Cloud service account keys
• Vault tokens and CI environment secrets

It also establishes persistence by modifying local project files such as .vscode/tasks.json and .claude/settings.json, allowing re-execution even after the malicious package is removed.

Unlike earlier variants, this wave uses encrypted exfiltration channels, including:

• Session-based peer-to-peer network traffic over HTTPS
• Encrypted payload transmission using AES-256-GCM and RSA-OAEP
• GitHub repositories as fallback exfiltration storage

This approach makes detection significantly harder, as traffic blends with legitimate encrypted communications.

A notable tactic in this campaign is the deliberate targeting of inactive packages. Projects that had not been updated for years were more likely to have outdated security practices, unrotated tokens, or lack modern protections like trusted publishing.

This strategy enabled attackers to gain access to high-impact packages with minimal resistance.

Mitigation and Recommendations

Security researchers strongly advise developers and organizations to take immediate action:

• Avoid installing or upgrading affected packages.
• Pin dependencies to known safe versions.
• Use npm install –ignore-scripts to prevent lifecycle scripts from running.
• Rotate all credentials if any affected package was installed on May 19.
• Monitor for unusual CI/CD activity or unauthorized package updates.

This incident represents one of the most advanced npm supply chain attacks to date. By combining worm-like Propagation, credential harvesting, and trusted signature abuse, Mini Shai-Hulud continues to evolve into a highly sophisticated threat targeting developer ecosystems.

The campaign also reinforces a critical lesson: even verified packages with valid provenance cannot be blindly trusted without validating the integrity of the publishing source.

Indicators of Compromise

File Indicators

File / Path	Notes
index.js at package root in any @antv/* package	~500KB; SHA-256 for @antv/l7-core: a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c
<project>/.claude/settings.json	Check for SessionStart hook
<project>/.vscode/tasks.json	Check for "runOn": "folderOpen"
<project>/.github/workflows/format-check.yml	Injected secrets-exfiltration workflow

Dependency / Registry Indicators

Indicator	Notes
github:antvis/G2#1916faa365f2788b6e193514872d51a242876569 in optionalDependencies	Phantom commit — jest-canvas-mock@2.5.3 and @antv/l7-core@2.26.10
github:antvis/G2#7cb42f57561c321ecb09b4552802ae0ac55b3a7a in optionalDependencies	Phantom commit — size-sensor@1.0.4
@antv/setup in any optionalDependencies	Should not exist in any legitimate package

Network Indicators

Indicator	Notes
filev2.getsession[.]org/file/	Primary exfiltration channel over Session P2P — TCP/443
github.com/oven-sh/bun/releases/download/bun-v1.3.13/ during npm install	Bun runtime fetch — anomalous for most pipelines

Code Markers (in embedded payloads)

Marker	Notes
__DAEMONIZED	Re-entrancy guard present in all embedded payloads in this family
0x19000	Exfiltration buffer flush size (102,400 bytes)
ACTIONS_ID_TOKEN_REQUEST_TOKEN	OIDC runtime token minting, in plaintext
VAULT_TOKEN	HashiCorp Vault harvesting, in plaintext
169.254.169.254	AWS IMDSv2 endpoint, in plaintext
169.254.170.2	AWS ECS task metadata endpoint, in plaintext

Git / GitHub Indicators

Indicator	Notes
Commits authored by claude@users.noreply.github.com not from the Claude Code GitHub App	Worm propagation commits
Repositories with description "A Mini Shai-Hulud has Appeared"	Exfiltration dead-drop repositories
Unexpected package versions with Sigstore provenance published after 01:39 UTC May 19	Worm propagation output – provenance will appear valid

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.