# Mini Shai-Hulud Supply Chain Attack Compromises 639 Malicious npm Package Versions Across @antv Ecosystem
A sophisticated software supply chain attack campaign has successfully infiltrated the npm registry, exploiting a compromised maintainer account to distribute trojanized packages across the widely-used @antv visualization ecosystem. Security researchers have identified 639 malicious package versions distributed across 323 unique packages, marking one of the largest coordinated npm compromises to date.
## The Threat
Researchers at Socket and SafeDep discovered that attackers leveraging the compromised npm maintainer account "atool" pushed malicious versions of high-profile open-source packages in a coordinated 22-minute burst. The attack affected a sprawling ecosystem of data visualization and graphing libraries, including:
The attack is attributed to the Mini Shai-Hulud campaign, a financially motivated threat actor operation reportedly conducted by TeamPCP. The malware employs a dual-stage execution mechanism designed to maximize persistence and credential harvesting across diverse development environments.
## Background and Context
### The Mini Shai-Hulud Campaign
The Mini Shai-Hulud campaign represents an escalation in npm ecosystem exploitation. First identified earlier this year, the operation follows a consistent pattern: compromise a high-value maintainer account with access to popular packages, then rapidly publish poisoned versions using stolen credentials and automation tools.
What distinguishes this campaign is its self-replicating architecture. Rather than requiring fresh compromises, the malware itself contains logic to propagate through additional packages using harvested npm tokens, creating a cascading effect through the dependency tree.
The operation's most concerning aspect emerged recently when TeamPCP released the entire Mini Shai-Hulud source code to other threat actors, transforming a targeted campaign into a widely available toolkit. This weaponization suggests the threat landscape will see copycat attacks from multiple adversaries using identical or modified variants.
### The "Shai-Hulud" Naming
The repositories created as fallback exfiltration channels contain descriptions reading "niagA oG eW ereH :duluH-iahS," which reverses to "Shai-Hulud: Here We Go Again" — a reference to Frank Herbert's *Dune* that signals the attackers' confidence and mockery of detection efforts. As of the discovery date, over 2,200 GitHub repositories contain this marker.
## Technical Details
### Multi-Stage Infection Chain
The compromised packages employ two distinct execution paths to establish persistence:
Primary Vector: Each malicious version adds a preinstall hook that executes arbitrary code (bun run index.js) during package installation.
Redundant Vector: 630 of 631 malicious versions inject an optionalDependencies entry pointing to imposter commits hosted on the legitimate antvis/G2 GitHub repository, delivering a second payload copy for increased success rate.
This dual approach ensures that even if one execution path is blocked or detected, the alternative maintains infection capability.
### The Payload
The stealer payload harvests a comprehensive range of credentials and secrets, targeting over 20 different credential types:
| Target System | Purpose |
|---|---|
| Cloud Providers | AWS, Google Cloud, Microsoft Azure credentials and keys |
| Code Repositories | GitHub tokens, SSH keys, git configurations |
| Container Orchestration | Kubernetes credentials, kubeconfig files |
| Secret Management | HashiCorp Vault tokens and configurations |
| SaaS Platforms | Stripe API keys and other payment service tokens |
| Databases | Connection strings for PostgreSQL, MySQL, MongoDB, and other databases |
| Container Runtime | Docker socket access for potential container escape |
The collected data undergoes multi-stage encoding: serialization → compression → encryption before exfiltration to the command-and-control domain at t.m-kosche[.]com:443.
### Fallback Exfiltration
If direct C2 communication fails, the malware leverages stolen GitHub tokens to:
1. Create a public repository under the victim's account (creating obvious security red flags)
2. Commit the harvested data as JSON files
3. Use the easily-identifiable repository description to signal successful infection
This fallback mechanism is simultaneously crude and effective — while highly detectable, it ensures data exfiltration succeeds even with network-level blocking.
### Self-Propagation Logic
Perhaps most concerning, the malware incorporates npm propagation logic that:
1. Validates stolen npm tokens through the official npm registry API
2. Enumerates all packages maintained by the token owner
3. Downloads legitimate package tarballs
4. Injects the malicious payload into source code
5. Modifies package.json to add preinstall hooks
6. Increments version numbers
7. Republishes using the compromised maintainer's identity
This automation transforms each newly infected developer account into an attack vector against hundreds of additional packages.
## Blast Radius and Impact
### Scale of Compromise
The 22-minute publication burst across 314 packages represents highly automated, coordinated action. The identical obfuscated payload and synchronized timing eliminate any possibility of gradual or targeted operation — this was automated mass poisoning via stolen credentials.
Downstream exposure is substantial. Organizations using any affected @antv package, echarts-for-react, or the numerous visualization libraries in the ecosystem face potential compromise if they:
### Developer Supply Chain Risk
Development teams are particularly vulnerable because:
A single compromised dependency could grant attackers access to Amazon Web Services accounts, GitHub organizations, Kubernetes clusters, and database credentials for organizations multiple layers downstream in the dependency tree.
## Recommendations for Defenders
### Immediate Actions
1. Audit npm Dependencies: List all direct and transitive dependencies to identify affected packages
2. Check npm Token Exposure: If your organization maintains npm packages, regenerate all publishing tokens and review access logs
3. Review Cloud Credentials: Assume any credentials stored in build environments may be compromised; rotate AWS, GCP, Azure, and GitHub keys
4. Scan Build Logs: Search CI/CD logs for suspicious npm operations, unusual repository creations, or GitHub actions from the attack window
### Medium-Term Controls
### Long-Term Strategy
## HackWire Analysis
The Mini Shai-Hulud campaign's source code release represents a critical inflection point in npm ecosystem security. What began as a targeted operation by sophisticated actors has now become a toolkit available to any threat actor with basic coding skills. This democratization of supply chain attack techniques suggests we're entering a period of sustained, high-volume npm compromises.
The pattern is familiar from previous registry attacks: maintainer account compromise followed by rapid mass-publishing. What's evolved is the sophistication of propagation logic. Rather than targeting single packages, this malware becomes a multiplier — each infected developer becomes an unwilling vector spreading the attack deeper into the dependency tree. For organizations that automatically update dependencies without pinning versions, the attack surface is enormous.
The fallback exfiltration via GitHub — using stolen tokens to commit data in publicly-created repositories — is simultaneously a weakness (highly detectable) and a strength (persistence through alternative channels). It signals that attackers prioritize data exfiltration over stealth; they're confident they can extract value before detection.
The credential targeting is telling: the breadth (20+ types) suggests these attackers have thoroughly mapped the secrets development environments contain. Kubernetes configs, Vault tokens, and database connection strings indicate they're not simply harvesting cloud provider access — they're targeting the entire infrastructure-as-code supply chain. A single compromised npm package could grant persistent access to production environments.
Organizations using @antv packages should treat this as equivalent to a supply chain breach in their own company. The question isn't "did we pull a malicious version?" but rather "which of our secrets were potentially exposed, and do we need to assume our infrastructure is compromised?" That level of consequence — from a package known for rendering charts — should accelerate investment in dependency isolation and security monitoring.
— HackWire Editorial
## Related Coverage