# Over 320 NPM Packages Compromised in Fresh Mini Shai-Hulud Supply Chain Attack


A massive supply chain attack has compromised the npm maintainer account 'atool' and leveraged it to distribute malicious code across 320+ packages, including two extraordinarily popular libraries used by millions of developers worldwide. The attack represents the latest iteration of the Mini Shai-Hulud campaign—a sophisticated, multi-stage operation designed to steal cloud credentials, CI/CD secrets, and cryptocurrency wallets from compromised systems.


## The Threat


Security researchers at Socket, Wiz, StepSecurity, and Microsoft have confirmed that the compromised account, which maintains packages across the @antv namespace, was used to publish at least 639 malicious versions of affected packages. Two particularly high-impact targets were compromised:


  • timeago.js — 1.5 million weekly downloads, a date/time formatting library used across countless applications
  • echarts-for-react — 1.1 million weekly downloads, a React wrapper for the popular ECharts visualization library

    • The malicious versions were published with obfuscated payloads designed to execute during installation, triggering a multi-stage infection chain that downloads additional payloads from attacker-controlled GitHub repositories.


    "The attack propagated downstream to other highly popular packages, impacting a much broader set of applications and continuous integration (CI) environments," Microsoft warned in its official analysis.


    ## Campaign Scale and Scope


    This compromised npm account is part of a much larger campaign tracked as Mini Shai-Hulud:


    | Metric | Count |

    |--------|-------|

    | Total malicious versions identified | 1,055 |

    | Unique packages affected | 502 |

    | NPM versions (primary target) | 1,048 versions across 498 packages |

    | PyPI packages compromised | 6 versions across 3 packages |

    | Composer packages compromised | 1 package-version entry |

    | GitHub repositories containing exfiltrated data | 2,200+ |


    The overwhelming majority of the activity targets the npm ecosystem, making this attack one of the most extensive supply chain compromises in recent memory.


    ## Background and Context


    ### What is Mini Shai-Hulud?


    Mini Shai-Hulud is an ongoing supply chain attack campaign that has been systematically compromising developer tool packages across multiple package ecosystems. The campaign is notable for its sophisticated credential harvesting and multi-stage payload delivery mechanisms.


    Named after a creature from Frank Herbert's science fiction, the campaign earned its designation due to its secretive, pervasive nature—spreading through package registries like sand through a desert. Previous iterations have hit packages across npm, PyPI, and PHP Composer, always with the same malicious objectives: stealing credentials and establishing persistence.


    ### Attribution to TeamPCP


    Security researchers attribute this attack campaign to TeamPCP, a hacking group known for supply chain attacks. The attribution is based on several technical indicators:


  • Data exfiltration patterns: The malware exfiltrates stolen credentials through both GitHub-hosted repositories and a fallback command-and-control server—a signature technique used by TeamPCP in prior Mini Shai-Hulud campaigns
  • Payload consistency: The obfuscated install-time payloads follow patterns established in previous attacks attributed to the group

    • ## Technical Details


    ### The Multi-Stage Attack Chain


    The malicious payload follows a sophisticated infection process:


    Stage 1: Installation Trigger

  • Malicious preinstall hooks execute during npm install
  • Obfuscated code remains hidden from casual code review
  • Multi-stage payload architecture downloads secondary components from attacker infrastructure

    • Stage 2: Credential Harvesting

    The payload systematically searches and steals credentials from over 130 file paths, including:


  • Cloud platforms: AWS credentials, GCP service accounts, Azure authentication tokens
  • Kubernetes: Config files and API tokens
  • Secrets management: HashiCorp Vault credentials
  • Development tools: SSH keys, personal access tokens, API keys
  • Cryptocurrency: Wallet files and private keys
  • CI/CD systems: GitHub Actions secrets, GitLab tokens, CircleCI credentials

    • ### GitHub Actions Memory Extraction


    One of the most dangerous capabilities the malware possesses is the ability to extract masked secrets from GitHub Actions runner memory in plaintext.


    GitHub Actions runners employ masking to hide secrets in logs—but the malware reads the runner process memory directly, bypassing this security layer entirely. This gives attackers access to unmasked AWS keys, deployment tokens, and other high-value secrets.


    ### NPM Registry Abuse Logic


    The compromised packages include logic to:


  • Validate npm authentication tokens through the official npm registry API
  • Enumerate all packages maintainable by the compromised account owner
  • Download package tarballs from npm
  • Inject malicious payloads into legitimate packages
  • Add preinstall hooks to trigger the malicious code
  • Bump version numbers and republish modified packages

    • This creates a cascading compromise scenario where a single compromised account can be weaponized to spread malware through an entire namespace of related packages—which is exactly what occurred with the @antv namespace.


    ### Python Execution and Backdoors


    Unlike previous Mini Shai-Hulud campaigns, this variant includes capabilities not seen before:


  • Python code execution: The payload downloads and executes arbitrary Python code from attacker infrastructure, providing ongoing remote access
  • Claude Code backdoors: StepSecurity identified the malware installing persistent backdoors into Claude Code, a popular development environment
  • Continuous access: The remote execution capabilities suggest the attackers have maintained an ability to install additional malware or steal data at will

    • ## Affected Packages and Services


    Beyond the @antv namespace, the compromise extended to other critical infrastructure:


  • Microsoft Durabletask Python SDK: Three malicious versions uploaded to PyPI within a 35-minute window
  • actions-cool/issues-helper: A popular GitHub Action used for issue triage and automation also compromised in this campaign

    • ## Implications for Organizations


    ### Immediate Risk


    Organizations using any of the 320+ affected packages face several critical risks:


    1. Credential theft: If developers installed the malicious versions, attackers have extracted all credentials on those machines

    2. CI/CD compromise: GitHub Actions runners have been compromised and their secrets stolen

    3. Lateral movement: Stolen cloud credentials could allow attackers to access production environments

    4. Supply chain extension: Compromised npm tokens mean attackers may have republished malicious versions of additional packages


    ### Downstream Impact


    Given the enormous popularity of affected packages like timeago.js and echarts-for-react, this attack likely compromised:


  • Thousands of applications used by millions of end users
  • Enterprise CI/CD pipelines that automatically update dependencies
  • Development machines where engineers installed vulnerable versions

    • ### Long Tail Risk


    Even organizations that have patched or removed affected packages face ongoing risk. The 2,200+ GitHub repositories containing exfiltrated credentials mean attackers have access to:


  • Production deployment keys
  • Cloud provider credentials
  • Cryptocurrency wallets
  • Private source code repositories

    • ## Recommendations


    ### For Developers and DevOps Teams


    Immediate actions:


  • Audit npm dependencies for affected packages; use npm audit or similar tools to identify compromised versions
  • Upgrade affected packages to patched versions (npm, Wiz, and StepSecurity have published patched versions)
  • Rotate all credentials on machines where malicious versions were installed
  • Rotate GitHub Actions secrets and regenerate personal access tokens
  • Review GitHub Actions logs for suspicious activity between when malicious versions were installed and when they were removed
  • Scan for Claude Code backdoors if you use that development environment

    • Medium-term mitigations:


  • Implement dependency scanning in CI/CD pipelines to detect known vulnerabilities
  • Use package signature verification where available
  • Monitor npm package activity for suspicious updates or version jumps
  • Restrict npm token permissions to the minimum required scope
  • Enable 2FA on npm accounts and GitHub accounts
  • Implement Software Composition Analysis (SCA) tools to track open-source dependencies

    • Long-term hardening:


  • Adopt zero-trust architecture for CI/CD systems
  • Implement secret scanning to detect accidentally committed credentials
  • Use ephemeral secrets rather than long-lived tokens in CI/CD environments
  • Regular security audits of development infrastructure

    • ### For Security Teams


  • Treat this as a potential breach incident if affected packages were in your environment
  • Coordinate with cloud providers to review account activity during the compromise window
  • Review threat intelligence on TeamPCP's previous targets and techniques

    • ## HackWire Analysis


    This attack reveals a critical vulnerability in how modern software supply chains operate: a single compromised maintainer account can compromise hundreds of downstream packages simultaneously. Unlike previous supply chain attacks that targeted individual packages, this campaign weaponized the trust placed in @antv namespace packages to achieve cascade compromise.


    The technical sophistication is particularly concerning. The ability to extract plaintext secrets from GitHub Actions runner memory—defeating GitHub's masking protections—represents a new escalation in CI/CD targeting. For years, developers have relied on platform-provided secret masking as a defensive control. This attack demonstrates that's insufficient against determined adversaries with code execution.


    What's also notable is the pattern: TeamPCP has now successfully compromised multiple major package ecosystems (npm, PyPI, Composer) using similar techniques. This suggests they have systematic intelligence about package maintainer workflows and common credential locations. Organizations need to assume that credential harvesting from developer machines is now a standard attack objective, not an exotic concern.


    The shift toward Python code execution and Claude Code backdoors signals that attackers aren't content with one-time credential theft—they're establishing persistent footholds for ongoing access. This transforms the compromise from a discrete incident into a potential long-term breach.


    For developers, the core lesson is uncomfortable: installing dependencies should now be treated with the same caution as running untrusted code, because at scale, it effectively is. The npm ecosystem's convenience—installing with a single command—has created an environment where malware can propagate to millions of machines through trusted channels before detection. Until package repositories implement stronger verification mechanisms or the ecosystem shifts toward more restrictive trust models, supply chain attacks will remain a dominant threat vector.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)