AI-Assisted Supply Chain Attacks | Stay protected with Chainguard

Aug 11, 2026

Multiple npm publishers released malicious forks of baileys, the popular WhatsApp Web library for Node.js, with 3M+ downloads per month. The campaign spanned 85 malicious package names across 381 versions, including 343 versions of baileys forks and 38 versions of libsignal-node impersonators. The malicious code operates through the developer's authenticated WhatsApp session. It makes the account follow attacker channels, then mutes them to hide the subscription. Some forks inject an advertising URL into each image and video the bot sends. One fork adds false channel attribution to outgoing messages. One fork sends a message from the account and then blocks the bot. The legitimate baileys library gets approximately 3M downloads each month, which makes its name an attractive lure. The campaign continues to grow, and the confirmed count is a lower bound. Each package belongs to a different npm account with a different maintainer email address, and most follow different attacker-controlled channels. It appears that independent operators reused the same attack pattern, rather than a single consolidated group, which is why this attack keeps growing.

Backdoored package

Aug 04, 2026

keyv/cacheable

On August 4, 2026, an attacker compromised the GitHub account of the maintainer behind keyv and cacheable and pushed malicious commits directly to the main branch before cutting new npm releases. The payload, a descendant of the Mini Shai-Hulud malware family, harvests npm, GitHub, Amazon Web Services (AWS), Kubernetes, HashiCorp Vault credentials, and database and private-key material, and exfiltrates them to a dedicated domain and to GitHub repositories created under compromised identities. It separately queries an Ethereum smart contract to resolve its command-and-control domain, letting the operator rotate infrastructure without changing the payload. Finally, the payload acts as a worm and pushes malicious versions using stolen npm credentials. To date, hundreds of npm packages are affected, totaling 2B+ monthly downloads.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

keyv 6.0.0@cacheable/ (3 versions)cacheableflat-cache 6.1.24file-entry-cachecacheable-request 13.0.20cache-manager 7.2.102,200+ other npm artifacts totaling 2B+ monthly downloads

Impact:

The malware harvests npm registry tokens, GitHub personal access tokens, OpenID Connect (OIDC) tokens, Amazon Web Services (AWS) credentials, Kubernetes credentials, and HashiCorp Vault tokens from any system that has run npm install on a compromised artifact. It validates npm tokens against npm's live API before exfiltrating them. It then sends stolen data to a dedicated domain and to GitHub repositories created under compromised identities, while separately querying Ethereum RPC endpoints to resolve its command-and-control domain. Anyone who installed an affected package is at risk. Given the scope of packages and their collective 2B+ monthly downloads, the fallout of this attack will take weeks to unravel.

Remediation:

Check installed versions and lockfiles against the confirmed malicious versions
Check for persistence artifacts before rotating any credentials, some versions of this malware family trigger destructive behavior when a stolen token is revoked
Downgrade to a verified clean release
Rotate all exposed credentials in order (npm, GitHub, AWS, Kubernetes, HashiCorp Vault)
Block egress to the identified command and control domains
Audit cloud and source control logs for unauthorized access
Rebuild any system that executed the preinstall hook or opened a cloned copy of an affected repository in VS Code or Claude Code
Upgrade to npm 12 or install with --ignore-scripts to block unapproved lifecycle scripts going forward

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Why Chainguard is safe

No Chainguard Libraries customer pulled an affected version of these packages, so this campaign did not reach Chainguard environments. Chainguard Libraries applies multiple layers of protection, building the newest and most popular packages from verified source, and running malware and greyware scanning plus cooldown periods across the broader catalog before any release reaches customers. Scanning and cooldowns are what caught this campaign, regardless of how the malicious code entered the package. While the rest of the industry spends the day on triage and credential rotation, Chainguard customers keep shipping.

Jul 14, 2026

@AsyncAPI

An attacker exploited a pull_request_target misconfiguration in the AsyncAPI generator repository's GitHub Actions workflow to steal a privileged personal access token, then used it to publish five trojanized versions across four @asyncapi npm packages with valid provenance. The payload installs a credential-stealing remote access trojan that fires on require(). Collectively, the projects are downloaded more than 2.5M times per month.

CI/CD Hijacking

Attack overview

Compromised artifacts

npm Packages:

@asyncapi/generator 3.3.1@asyncapi/generator-helpers 1.1.1@asyncapi/generator-components 0.7.1@asyncapi/specs 6.11.2-alpha.1@asyncapi/specs 6.11.2

Impact:

Any environment that imported or required an affected version is at risk of credential theft, including browser-saved passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets, as well as ongoing command-and-control access. Two design choices here demonstrate the attacker's sophistication. First, triggering on require() rather than an install-time script bypasses the install-time script blockers that many defenses are built around. This makes the payload invisible to the tooling meant to catch it. Second, the attacker didn't publish anything themselves. Instead, they pushed one malicious commit to a branch already wired into AsyncAPI's release automation and let CI/CD build and publish all five trojanized versions with legitimate provenance. This attack style used the target's own infrastructure as the delivery mechanism.

Remediation:

Downgrade immediately: pin to @asyncapi/generator@3.3.0, @asyncapi/generator-helpers@1.1.0, @asyncapi/generator-components@0.7.0, and @asyncapi/specs@6.11.1, and verify with npm ls.
Remove the dropped payload at the platform-specific path before rotating credentials, and kill any orphaned detached node processes.
Rotate exposed credentials: npm tokens, GitHub tokens and CLI config, SSH keys, cloud (AWS, GCP, Azure) credentials, and browser-saved passwords, in that order.
Audit CI/CD: any pipeline that ran npm install or imported these packages during the compromise window should have its secrets rotated and be treated as compromised.
Block egress to 85.137.53.71 and monitor for outbound traffic to IPFS gateways and rentry[.]co from build infrastructure.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Why Chainguard is safe

Chainguard uses multiple layers of defense to ensure malicious packages are unavailable for consumption. Customers were protected via configurable cooldowns, and when building from source, builds failed from static analysis that compares our build to upstream.

Jun 17, 2026

@mastra/*

On June 17, 2026, an attacker used a compromised former contributor npm account to republish all packages in the @mastra npm scope between 01:15 and 02:00 UTC. The mastra project is used for agentic development, native LLM and MCP integrations. The attacker added a malicious runtime dependency to all mastra projects named easy-day-js@1.11.22, whose postinstall hook disables TLS verification, downloads a crypto wallet stealer and RAT from attacker-controlled infrastructure, runs them detached, and self-deletes. This attack weaponizes organizations focused on AI development as the mastra dependency tends to run in highly sensitive production environments.

Install-Time Script

Jun 04, 2026

Phantom Gyp Worm

On June 3, 2026, attackers compromised 286 versions across 57 npm projects using a novel install-time execution technique called "Phantom Gyp." Rather than using the preinstall or postinstall lifecycle scripts that most security tools monitor, the attacker injected a 157-byte binding.gyp file that triggers code execution through node-gyp during npm install, bypassing lifecycle-script-based defenses entirely. Collectively, the impacted projects had more than 500K+ monthly downloads. Malicious artifacts were live on npm for just under two hours. The payload is the Miasma worm, the eighth wave of the Shai-Hulud/Miasma attack campaign that began in September 2025, and the second attack in four days. The worm is designed to exfiltrate npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, Kubernetes, and RubyGems credentials. This wave introduced the Phantom Gyp technique as a new evasion method, along with a novel AI coding assistant backdoor targeting .claude/ hooks, Cursor AI, and Gemini configuration directories. The worm also contains a destructive tripwire: if a planted decoy token is touched, it executes rm -rf ~/ to wipe the victim's home directory.

Maintainer Compromise

Attack overview

Compromised artifacts

npm Packages:

@vapi-ai/server-sdk (4 versions)ai-sdk-ollama (4 versions)50+ projects, including autotel, awaitly, executable-stories-*, and more

Impact:

Any developer or CI pipeline that ran npm install on an affected package version between June 3, 2026, 23:30 UTC and June 4, 2026 should treat the environment and private credentials as fully compromised. The worm executes before application code loads and without any visible indication during install. Beyond credential theft, affected environments face three additional risks. First, any npm or RubyGems packages the victim maintains may have had poisoned versions published without their knowledge. Second, GitHub Actions workflows in any repository the victim's token could write to may have been modified to re-execute the worm on every future CI run. Third, the worm drops persistent backdoor configuration files into AI coding assistant directories (.claude/, Cursor AI, Gemini), meaning the compromise can survive package removal and re-execute when the developer next opens the project in an AI-assisted IDE. A destructive tripwire runs rm -rf ~/when a planted decoy token is interacted with. Credential rotation must be performed from a clean machine before touching any credentials from the affected environment.

Remediation:

Before taking any action, isolate the affected machine or CI runner from the network. Do not run commands on it or interact with any credentials from it until rotation is complete from a clean machine.
Rotate all private credentials from an unaffected machine.
Audit GitHub Actions workflows in every repository that the compromised account could write to. Look for unexpected setup-bun steps or unexplained commits. Revert affected workflows to a known-good state.
If you maintain npm packages, check the publish history for unexpected versions published between June 3 and June 4. Unpublish malicious versions with npm unpublish and notify downstream users.
Remove file artifacts: rm -f "$TMPDIR"/bun* and rm -f /tmp/bun*. Inspect ~/.claude/, Cursor AI config directories, and Gemini config for unexpected files. Check ~/.npmrc , ~/.aws/credentials , and ~/.kube/config for tampering.
Block egress to t.m-kosche[.]com . Pin all affected packages to versions predating June 3, 2026. Do not treat a clean latest dist-tag as evidence of safety as malicious versions remain available as exact-pinned tarballs on the registry.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Actions

Containers

Why Chainguard is safe

Chainguard Libraries for JavaScript customers were not affected. Chainguard builds JavaScript packages from source in the Chainguard Factory rather than consuming upstream registry tarballs. Compromised npm tarballs, including all 286 malicious Miasma versions, have no path into the Chainguard build pipeline. The Phantom Gyp binding.gyp execution, the preinstall hook, and the Bun runtime download all occur within the npm install process against a registry tarball. That process does not happen in Chainguard's build environment. All 286 malicious versions were also blocked in the Chainguard Libraries blocklist and malware blocklist and were never served via our upstream fallback to npm. Chainguard Containers customers were not affected. Container images are rebuilt daily from source in the Chainguard Factory. A compromised upstream npm tarball does not affect container image builds. Unlike scanners or policy engines that block malware once it is already in the wild, Chainguard Libraries offers multiple layers of security controls to prevent supply chain threats before they ever enter your environment

Jun 01, 2026

@redhat-cloud-services

An attacker compromised a Red Hat employee's GitHub account and used the associated GitHub Actions OIDC trusted publisher to ship malicious versions across 90+ projects. The confirmed delivery vector, patch-client@4.0.4, executes via a preinstall hook, which deploys an obfuscated payload that harvests cloud credentials, CI secrets, and registry tokens. The worm self-propagates by republishing tampered npm tarballs and injecting malicious GitHub Actions workflows into accessible repositories. This is the latest attack in the Mini Shai-Hulud toolkit.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

@redhat-cloud-services/* (32 projects; 90+ versions)

Impact:

The compromised packages span Red Hat's cloud services frontend ecosystem that has 100K+ weekly downloads. The payload targets the full credential chain across AWS, Azure managed identity, GCP service accounts, HashiCorp Vault, Kubernetes service account tokens, GitHub PATs, npm tokens, Bitwarden, and gopass vaults, and approximately 40 CI provider credential patterns including NPM_TOKEN, GITHUB_TOKEN, CIRCLE_TOKEN, and ANTHROPIC_API_KEY. The attacker used a Red Hat employee’s GitHub account to abuse GitHub Actions OIDC trusted publishing to mint valid publish tokens without a static NPM_TOKEN, and the same publishing path covers all 95 projects in the namespace. This means that a single compromised workflow run could yield tokens for every package. The worm exfiltrates stolen credentials to attacker-created public GitHub repos (description: "Miasma: The Spreading Blight"), republishes poisoned npm tarballs signed via Sigstore/Fulcio, and injects a YAML file on a new branch, disguising malware as a legitimate security improvement to trick maintainers into merging. To date, 290+ repositories are affected. The payload checks for CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before executing, and installs persistence via .claude/settings.json and .vscode/tasks.json.

Remediation:

If you installed patch-client@4.0.4, treat all credentials reachable from that host or CI runner as compromised. Rotate AWS keys, npm tokens, GitHub PATs, and Vault tokens immediately.
Check for persistence artifacts before rotating credentials: .claude/settings.json, .vscode/tasks.json, and /tmp/kitty-* daemon paths on affected systems.
Pin to patch-client@4.0.3 or earlier. Verify tarballs against known-good SHA256 hashes — lockfile presence alone is insufficient as the worm tampers with tarballs in transit.
Audit all @redhat-cloud-services/* packages for unexpected publish timestamps around June 1, 2026.
Review .github/workflows/ for unexpected commits, especially PRs adding codeql.yml on branch chore/add-codeql-static-analysis, and check for unexpected public repositories under your accounts.
Block the Bun runtime download URL and monitor for /tmp/p*.js, /tmp/b-*/bun, and /tmp/kitty-* runtime artifacts.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Actions

Why Chainguard is safe

Mini Shai-Hulud "Miasma" delivers its payload via npm preinstall lifecycle hooks. Chainguard doesn't build libraries that use install-time scripts, as they have shown to often carry malicious payloads, meaning none of the 90+ compromised versions exist in the Chainguard Libraries for JavaScript catalog. The malicious versions were also never served via the upstream fallback, which is protected by a cooldown period. Chainguard customers using Chainguard Actions would not be affected by this injected codeql.yml workflow. Chainguard Actions hardens and re-publishes upstream actions, with each hardened action pinning its internal uses: and container image references to immutable SHAs.

May 27, 2026

183 npm Packages Target Cloud and Finance via oob.moika.tech

A single threat actor operating four npm accounts (mr.4nd3r50n, pik-libs, t-in-one, emcd-vue) published 183 malicious packages across nine scoped namespaces in four waves between May 27 and June 1, 2026. The campaign used dependency confusion — publishing high-version (99.99.99) packages to the public npm registry under names that shadow internal corporate namespaces — targeting a Russian cloud platform provider, a financial institution, Sberbank's payment ecosystem, and the EMCD crypto exchange. Every package executes a postinstall hook that exfiltrates the victim's full process.env to an attacker-controlled C2 at oob.moika.tech, then downloads and spawns a detached second-stage process. The campaign evolved across four waves with increasing sophistication, from cleartext payloads in Wave 1 to WaCk/JScrambler obfuscation, home-directory persistence, and a structured FUSION_ second-stage protocol in Wave 4. A RECON_ONLY server-side flag indicates the attacker is in reconnaissance mode with full exploitation capability held in reserve.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

@cloudplatform-single-spa/* (122 packages; version 99.99.99)@mlspace/* (17 packages; version 99.99.99)@car-loans/* (19 packages; version 99.99.99)@fb-deposit/* (4 packages; version 99.99.99)@debit-ib/* (2 packages; version 99.99.99)@t-in-one/* (10 packages; version 5.7.1)@capibar.chat/ui-kit (versions 99.0.7, 99.5.7)@sber-ecom-core/sberpay-widget (versions 99.0.7, 99.5.8)@sber-ecom-core/sberpay-widget (versions 99.0.7, 99.5.8)

Impact:

The 183 packages span nine scoped namespaces mirroring specific internal service names — including billing, VPN, Kubernetes, ML inference, IAM, loan flows, deposit forms, debit card applications, and crypto exchange modules, indicating the actor profiled each target organization's internal package ecosystem before publishing. The specificity of package names such as @cloudplatform-single-spa/certificate-manager, @cloudplatform-single-spa/vpn, @cloudplatform-single-spa/ml-inference, and @sber-ecom-core/sberpay-widget confirms targeted reconnaissance rather than opportunistic squatting. On install, the postinstall hook transmits the victim's full process.env to oob.moika.tech — capturing any API keys, CI secrets, cloud credentials, npm tokens, GitHub PATs, or other secrets present in the developer or CI environment at install time. A second-stage binary is simultaneously fetched from https://oob.moika.tech/payload/{mac|win|linux}.js and spawned as a detached child process using .unref(), surviving after npm install exits. Wave 4 (June 1) introduced home-directory persistence, writing the payload to ~/.emcd-vue_init.js rather than os.tmpdir(), which survives reboots and OS temp cleanup. The RECON_ONLY=1 flag, currently set server-side, indicates that the actor is collecting environment fingerprints and holding exploitation for a follow-on phase. Server-side toggling means full exploitation can be enabled against already-compromised environments without requiring a new install. The campaign pre-staged benign versions of @capibar.chat/ui-kit and @sber-ecom-core/sberpay-widget on May 4, 2026 — 23 days before the malicious wave — to establish namespace presence and bypass registry age-based filters. All packages carried a shared hardcoded X-Secret header value (l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1) across all four accounts and all four waves, tying the entire campaign to a single operator.

Remediation:

If any of the affected package versions were installed on or after May 4, 2026 (pre-staged versions) or May 27, 2026 (malicious versions), treat all credentials present in that environment as compromised. Check package-lock.json, yarn.lock, and CI build logs to determine exposure.
Rotate credentials immediately in this order: npm tokens, GitHub PATs, AWS keys (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), GCP service account keys, Azure credentials, HashiCorp Vault tokens, and any other secrets present in process.env on affected machines.
Check for and remove persistence artifacts before assuming a clean state:
- /tmp/._cloudplatform-single-spa_init.js
- /tmp/._t-in-one_init.js
- ~/.emcd-vue_init.js
- ~/.cache/._t-in-one_init/
- ~/.emcd-vue_init/
Scope-lock all nine targeted npm scopes to your private registry in .npmrc to prevent public registry fallback resolution.
Block egress to oob.moika.tech, npm.t-in-one.io, docs.t-in-one.io, and jira.t-in-one.io at your network perimeter.
Use npm ci instead of npm install in all CI pipelines. npm ci installs exactly from the lock file and fails on discrepancy, preventing dependency confusion substitution.
Add --ignore-scripts to npm install in CI environments where lifecycle scripts are not required, preventing postinstall hooks from running at all.
Verify clean state by confirming no stager files remain, no outbound connections to oob.moika.tech appear in ~/.npm/_logs/, and no affected scopes appear in installed packages.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Why Chainguard is safe

The oob.moika.tech campaign delivers its payload exclusively via npm postinstall lifecycle hooks combined with dependency confusion — publishing malicious tarballs to the public npm registry under names that shadow internal corporate namespaces. Chainguard doesn't build libraries that use install-time scripts, as they have consistently shown to carry malicious payloads, meaning none of the 183 malicious packages were ever built into the Chainguard npm Libraries catalog. Even if a future wave targets a namespace Chainguard carries, the malicious versions would never be served via the upstream fallback, which is protected by a cooldown period that prevents newly published registry versions from being consumed immediately.

May 22, 2026

Laravel Lang

An attacker compromised the maintainer of the Laravel-Lang GitHub organization and, in a 15-minute automated burst, rewrote every git tag across four popular Composer packages. The rewritten tags inject a malicious autoload file that fires the moment any Laravel application boots, dropping a hidden PHP loader that harvests cloud credentials, CI secrets, browser passwords, SSH keys, and cryptocurrency wallets to a typosquatted domain before deleting itself from disk.

Maintainer Compromise

Attack overview

Compromised artifacts

Packagist Packages:

laravel-lang/lang (502 versions)laravel-lang/attributes (86 versions)laravel-lang/http-statuses (66 versions)laravel-lang/actions (46 versions)

Impact:

The attacker rewrote every existing git tag rather than publishing new versions, so any project running composer update or doing a fresh install resolved to poisoned code. Unlike typical registry compromises, no malicious code was committed to the official repositories. Instead, the attacker rewrote tags to point at commits in an attacker-controlled fork, leaving official commit histories clean. Attackers injected malware across 650+ versions across four packages were rewritten in approximately 15 minutes, indicating org-level credential compromise. The payload abuses Composer's autoload.files mechanism to register a dropper—a first-stage loader that fetches and executes the credential stealer—at every application startup. The second-stage payload is a full credential-harvesting framework with 17 distinct collectors targeting AWS/GCP/Azure cloud metadata, Kubernetes service account tokens, HashiCorp Vault secrets, CI/CD pipeline tokens (Jenkins, GitLab, GitHub Actions, CircleCI), browser login data (with a dedicated binary to bypass Chrome v127+ App-Bound Encryption), password managers (1Password, Bitwarden, LastPass, KeePass), cryptocurrency wallets, VPN configurations, SSH keys, and environment variables. Stolen data is XOR-encrypted and exfiltrated to an attacker-controlled domain before the dropper self-deletes from disk after execution, while continuing to run from memory, making forensic detection on live systems difficult. The full downstream impact is still to be understood.

Remediation:

Pin Composer dependencies by committing composer.lock to version control and running composer install instead of composer update in CI. A committed lockfile with a pre-attack SHA would have prevented this entirely.

Inspect composer.lock for these packages. If the lockfile was regenerated on or after 2026-05-22 23:41 UTC, treat the environment as compromised.

Rotate all secrets accessible to the compromised environment: CI tokens, cloud credentials, GitHub PATs, and deploy keys.

Block egress to flipboxstudio[.]info on all CI runners and developer machines.

Audit outbound DNS and HTTPS logs retroactively for requests to flipboxstudio[.]info to determine whether exfiltration occurred before the block was in place.

Check running processes for orphaned php and unnamed ELF processes with ppid=1 executing from deleted paths under /tmp.

Check /tmp/.laravel_locale/ for the dropper's execution marker — its presence confirms the dropper ran on that host.

Inspect git commit author metadata in vendor/laravel-lang/ for Your Name you@example.com — a direct indicator of malicious commits.

Chainguard protection

UNAFFECTED Chainguard Artifacts

Containers

Why Chainguard is safe

Chainguard's Laravel container image is built from verified upstream source and does not pull dependencies from Composer at runtime. The compromised laravel-lang packages were distributed through rewritten git tags on GitHub, which only affect environments that resolve Composer dependencies dynamically. Chainguard container images pin all dependencies at build time against verified source, so the poisoned tags were never incorporated.

May 18, 2026

@antv / Mini Shai-Hulud Wave 5

A compromised npm maintainer account published 639 malicious package versions across 323 packages in Alibaba’s AntV data visualization ecosystem in a 22-minute automated burst — the latest wave of Mini Shai-Hulud, the self-propagating npm supply chain worm that has hit CrowdStrike packages, the Nx build system, and TanStack over the past eight months. The payload fires via preinstall lifecycle hooks, sweeps 130+ credential file patterns, scrapes GitHub Actions runner memory to bypass secret masking, and exfiltrates via an OpenTelemetry-disguised HTTPS endpoint and a GitHub dead-drop under the victim's own account. Persistent backdoors are installed into Claude Code and VS Code configurations, and a long-lived C2 daemon enables arbitrary code execution on compromised machines indefinitely.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

echarts-for-react@3.0.7, 3.1.7, 3.2.7timeago.js@4.1.2, 4.2.2size-sensor@1.0.4, 1.1.4, 1.2.4@antv/scale@0.6.2, 0.7.2@antv/g6@5.2.1, 5.3.1

Impact:

The compromised packages collectively represent approximately 16 million weekly downloads spanning enterprise data visualization, charting, graph visualization, geospatial mapping, and spreadsheet rendering. The payload harvests the full AWS credential chain, Google Cloud, Azure, GitHub tokens, npm publish tokens, SSH keys, Kubernetes service account tokens, HashiCorp Vault tokens, Stripe keys, database connection strings, cryptocurrency wallets, and Claude AI API credentials. In GitHub Actions environments, the payload reads Runner.Worker process memory directly via /proc/[pid]/mem, recovering every masked secret in plaintext. A self-replicating worm component uses stolen npm tokens to automatically poison additional packages, extending the blast radius beyond the initial atool account compromise. Over 2,500 attacker-created GitHub repositories are publicly visible, each representing a confirmed credential theft from a unique environment.

Remediation:

Clear caches and reinstall using pinned package versions published before 2026-05-19 01:39 UTC.
Remove persistence before rotating credentials: stop and disable kitty-monitor systemd service (Linux) or LaunchAgent (macOS), delete ~/.local/share/kitty/cat.py, ~/.local/bin/gh-token-monitor.sh, .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, .vscode/setup.mjs, and .github/workflows/codeql.yml.
Rotate all credentials in this order: npm tokens, GitHub PATs and Actions secrets, AWS keys, GCP service accounts, Azure service principals, Kubernetes service account tokens, Vault tokens, SSH keys, database connection strings, and all remaining API keys.
Audit GitHub account for unexpected public repositories with Dune-universe names or the description niagA oG eW ereH :duluH-iahS.
Block t.m-kosche.com at the network perimeter for all CI runners and developer machines.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Actions

Why Chainguard is safe

Mini Shai-Hulud delivers its payload exclusively via npm lifecycle hooks: preinstall, postinstall, and prepare. Mini Shai-Hulud delivers its payload exclusively via npm lifecycle hooks: preinstall, postinstall, and prepare. Chainguard builds JavaScript libraries from source and does not include packages that require install-time scripts. The malicious AntV versions were never built into the Chainguard Libraries catalog, and the hooks that trigger the payload were never present. Customers using Chainguard Repository's upstream npm fallback are also protected — the default cooldown policy blocked the malicious versions from being served during the 39-minute attack window.

May 14, 2026

node-ipc

An attacker published three malicious versions of node-ipc directly to npm, injecting a credential harvester into the CommonJS entry point while leaving the ESM entry point clean. The payload fires on every require('node-ipc'), sweeps over 90 credential file patterns, and exfiltrates via DNS TXT queries to Google DNS and HTTPS POST to a typosquatted Azure domain.

Backdoored package

May 11, 2026

Mini Shai Hulud: npm & PyPI Worm

The TeamPCP campaign that began with the SAP compromise on April 29 returned at scale. Attackers exploited pull_request_target workflow vulnerabilities to hijack @TanStack's CI/CD pipeline and push malicious lifecycle scripts into 42 @TanStack packages across 84 versions. The poisoned @TanStack packages carried valid SLSA provenance — signed by TanStack's own CI pipeline — making them indistinguishable from legitimate releases. From there, the blast radius expanded to include 400+ npm and PyPI package versions across 100+ namespaces — including @mistralai, @uipath, and @squawk. Collectively, these dependencies have 500M+ monthly downloads. The malware silently harvests CI/CD secrets, cloud credentials, and GitHub tokens and includes a deadman's switch that deletes a developer's entire repository if the credential harvester's permissions are revoked. Note: This attack is different than the typosquat/brandsquat attack against TanStack from April 29, 2026.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

@tanstack/* (42 packages, 84 versions)@uipath/* (66 packages, 66 versions)@squawk/* (22 packages, 110 versions)@mistralai/* (3 packages, 9 versions)@tallyui/* (10 packages, 30 versions)@beproduct/nestjs-auth (18 versions)and 50 more versions across 15+ dependencies

PyPI Packages:

mistralai@2.4.6guardrails-ai@0.10.1

Impact:

Malicious lifecycle hooks exfiltrated GitHub tokens, npm publish credentials, AWS/Azure/GCP keys, Kubernetes configs, and environment variables from developer machines and CI/CD runners. The malware persists long after the infected package is removed: by writing itself into .claude/settings.json and .vscode/tasks.json, it re-executes every time a developer uses Claude Code or opens VS Code in the affected project directory. npm uninstall does not fix this. The novel deadman's switch makes standard incident response ineffective: rotating compromised credentials — the first thing any security team does — triggers automatic deletion of the developer's entire home directory, turning remediation into a destructive event. This is the first documented npm worm to ship with valid, attacker-generated SLSA provenance. The malicious packages were signed by TanStack's own CI pipeline, meaning cryptographic provenance (a signal defenders rely on to distinguish legitimate packages from tampered ones) provided no protection here. The deliberate targeting of @mistralai, @uipath, and AI tooling broadly signals this campaign's focus on AI development pipelines.

Remediation:

Check developer machines and project roots for gh-token-monitor daemon and remove it before rotating any GitHub tokens as the deadman's switch triggers on revocation.
Audit .claude/ and .vscode/ directories for router_runtime.js, setup.mjs, and unfamiliar entries in settings.json or tasks.json. These persist after npm uninstall.
Once persistence is cleared, rotate all credentials: GitHub tokens, npm tokens, AWS/Azure/GCP keys, Kubernetes service account tokens, and Vault tokens.