Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP) — Threadlinqs Intelligence
As of 2026-05-30, Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP) is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0446 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
On 2026-04-30 the Mini Shai-Hulud worm trojanized intercom-client@7.0.4 (~360k weekly downloads, 100+ dependents) on npm via a preinstall hook that downloads an unverified Bun runtime and executes an
OVERVIEW
Mini Shai-Hulud is the third-generation reincarnation of the Shai-Hulud npm worm family (original September 2025; Shai-Hulud 2.0 November 2025). On 2026-04-30 multiple vendors (Socket, Wiz, OX Security, The Hacker News) reported a coordinated supply-chain campaign in which the worm was published into widely-used JavaScript and Python packages over a roughly 47-minute exposure window. The flagship infection vector was intercom-client@7.0.4, the official Intercom Node.js SDK with approximately 360,000 weekly npm downloads and more than 100 known dependent projects, but the same actor simultaneously trojanized PyTorch Lightning 2.6.2 and 2.6.3 on PyPI (~2.1M weekly downloads) and four SAP-related npm packages: @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1, and mbt@1.2.48.
INITIAL ACCESS AND EXECUTION
Maintainer accounts were taken over (likely via phished or harvested 2FA-disabled credentials and reused npm/PyPI tokens). On the npm side, malicious versions were published with two payload files added to the package: setup.mjs and router_runtime.js. The package.json was edited so that setup.mjs is invoked from the preinstall lifecycle hook, guaranteeing execution the moment a victim runs npm install. setup.mjs (SHA-256 fe64699649591948d6f960705caac86fe99600bf76e3eae29b4517705a58f0e2) reaches out and downloads an unverified Bun runtime binary, drops router_runtime.js (SHA-256 5ae8b2343e97cc3b2c945ec34318b63f27fa2db1e3d8fbaa78c298aa63db52ed, ~11.7 MB heavily obfuscated JavaScript), and executes it under Bun. A Wiz-collected variant of setup.mjs (SHA-256 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34) carries the same logic with minor mutations.
The Python lightning compromise uses an analogous trick: a malicious setup script delivered through the wheel performs the same Bun + router_runtime.js handoff, allowing the JavaScript-based credential stealer to run identically across npm and PyPI ecosystems.
GUARDRAILS AND DEFENSE EVASION
router_runtime.js contains an execution guardrail that aborts on systems whose locale resolves to Russian language/region — the same killswitch observed in earlier TeamPCP-attributed compromises against Checkmarx and Bitwarden customers, and one of the strongest pieces of attribution evidence. Static obfuscation is multi-layered (string array shuffling, control-flow flattening) and the entire payload is embedded in a single ~11.7 MB file to overwhelm signature scanning and frustrate manual review.
CREDENTIAL HARVESTING
Once running, router_runtime.js performs a comprehensive sweep of the host:
- Filesystem scan for .npmrc, .yarnrc, ~/.config/gh, ~/.docker/config.json, ~/.aws/credentials, ~/.kube/config, ~/.vault-token, .env, .envrc, and Helm/Terraform state files;
- HTTP requests to AWS IMDSv1/v2 (169.254.169.254/latest/meta-data/iam/security-credentials/) and to metadata.google.internal to retrieve role STS tokens and GCE service-account tokens;
- Direct interrogation of git config and ~/.gitconfig to find personal access tokens (PATs) and GitHub App installation tokens;
- Enumeration of process environment variables, including CI/CD-injected secrets (GITHUB_TOKEN, NPM_TOKEN, NPM_AUTH_TOKEN, PYPI_TOKEN, AWS_*, GCP_*, KUBE*).
COMMAND AND CONTROL & EXFILTRATION
Harvested data is encrypted with an embedded RSA public key (the same key reused across previous TeamPCP campaigns) and exfiltrated over HTTPS to zero.masscan.cloud:443/v1/telemetry. If DNS resolution for zero.masscan.cloud fails, the worm falls back to a hardcoded IP at 94.154.172.43. In parallel, valid GitHub PATs are reused immediately to fork the contents of the victim's accessible repositories into attacker-controlled GitHub accounts. The new repositories are created with the description string 'A Mini Shai-Hulud has Appeared' and named using LAPSUS$/Dune-themed patterns: ghola-melange-*, mentat-melange-*, powindah-sietch-*. A separate dead-drop channel relies on GitHub's commit-sear
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software-development, cloud, saas, ai-ml, enterprise-software, financial, ci-cd
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1586, T1195, T1195.002, T1199, T1059.007, T1059.006, T1129, T1204.002, T1546