Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
Mini Shai-Hulud Resurfaces (TL-2026-0446), also tracked as Mini Shai-Hulud, is a critical-severity supply-chain compromise, first published 2026-04-30. It is attributed to TeamPCP with high confidence, affects Intercom intercom-client (npm), maps to 28 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0446
- Threat ID
- TL-2026-0446
- Also known as
- Mini Shai-Hulud, Shai-Hulud v3, intercom-client supply chain attack, PyTorch Lightning supply chain attack
- Severity
- CRITICAL
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-30
- Last reviewed
- 2026-04-30
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud, saas, ai-ml, enterprise-software, financial, ci-cd
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Mini Shai-Hulud Resurfaces
Malware and tooling: Custom Bun-based JavaScript stealer (Mini Shai-Hulud)
On 2026-04-30 the Mini Shai-Hulud worm trojanized intercom-client@7.0.4 (~360k weekly downloads, 100+ dependents) on npm via a preinstall hook that downloads an unverified Bun runtime and executes an obfuscated ~11.7 MB router_runtime.js to harvest GitHub PATs, npm tokens, AWS/GCP IMDS credentials, Kubernetes/Vault secrets, and environment variables. The same campaign poisoned PyTorch Lightning 2.6.2/2.6.3 on PyPI plus four SAP-related npm packages (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, mbt). Stolen secrets are exfiltrated to zero.masscan.cloud (fallback 94.154.172.43) and dead-dropped to attacker-controlled GitHub repos tagged with the description 'A Mini Shai-Hulud has Appeared' and the commit-search keyword 'beautifulcastle'; attribution to TeamPCP (LAPSUS$ overlap) rests on a shared RSA public key and a Russian language-region killswitch reused from prior Checkmarx/Bitwarden operations.
How Mini Shai-Hulud Resurfaces works
OVERVIEW
Mini Shai-Hulud is the third-generation reincarnation of the Shai-Hulud npm worm family (original September 2025; Shai-Hulud 2.0 November 2025). On 2026-04-30 multiple vendors (Socket, Wiz, OX Security, The Hacker News) reported a coordinated supply-chain campaign in which the worm was published into widely-used JavaScript and Python packages over a roughly 47-minute exposure window. The flagship infection vector was intercom-client@7.0.4, the official Intercom Node.js SDK with approximately 360,000 weekly npm downloads and more than 100 known dependent projects, but the same actor simultaneously trojanized PyTorch Lightning 2.6.2 and 2.6.3 on PyPI (~2.1M weekly downloads) and four SAP-related npm packages: @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1, and mbt@1.2.48.
INITIAL ACCESS AND EXECUTION
Maintainer accounts were taken over (likely via phished or harvested 2FA-disabled credentials and reused npm/PyPI tokens). On the npm side, malicious versions were published with two payload files added to the package: setup.mjs and router_runtime.js. The package.json was edited so that setup.mjs is invoked from the preinstall lifecycle hook, guaranteeing execution the moment a victim runs npm install. setup.mjs (SHA-256 fe64699649591948d6f960705caac86fe99600bf76e3eae29b4517705a58f0e2) reaches out and downloads an unverified Bun runtime binary, drops router_runtime.js (SHA-256 5ae8b2343e97cc3b2c945ec34318b63f27fa2db1e3d8fbaa78c298aa63db52ed, ~11.7 MB heavily obfuscated JavaScript), and executes it under Bun. A Wiz-collected variant of setup.mjs (SHA-256 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34) carries the same logic with minor mutations.
The Python lightning compromise uses an analogous trick: a malicious setup script delivered through the wheel performs the same Bun + router_runtime.js handoff, allowing the JavaScript-based credential stealer to run identically across npm and PyPI ecosystems.
GUARDRAILS AND DEFENSE EVASION
router_runtime.js contains an execution guardrail that aborts on systems whose locale resolves to Russian language/region — the same killswitch observed in earlier TeamPCP-attributed compromises against Checkmarx and Bitwarden customers, and one of the strongest pieces of attribution evidence. Static obfuscation is multi-layered (string array shuffling, control-flow flattening) and the entire payload is embedded in a single ~11.7 MB file to overwhelm signature scanning and frustrate manual review.
CREDENTIAL HARVESTING
Once running, router_runtime.js performs a comprehensive sweep of the host:
- Filesystem scan for .npmrc, .yarnrc, ~/.config/gh, ~/.docker/config.json, ~/.aws/credentials, ~/.kube/config, ~/.vault-token, .env, .envrc, and Helm/Terraform state files; - HTTP requests to AWS IMDSv1/v2 (169.254.169.254/latest/meta-data/iam/security-credentials/) and to metadata.google.internal to retrieve role STS tokens and GCE service-account tokens; - Direct interrogation of git config and ~/.gitconfig to find personal access tokens (PATs) and GitHub App installation tokens; - Enumeration of process environment variables, including CI/CD-injected secrets (GITHUB_TOKEN, NPM_TOKEN, NPM_AUTH_TOKEN, PYPI_TOKEN, AWS_*, GCP_*, KUBE*).
COMMAND AND CONTROL & EXFILTRATION
Harvested data is encrypted with an embedded RSA public key (the same key reused across previous TeamPCP campaigns) and exfiltrated over HTTPS to zero.masscan.cloud:443/v1/telemetry. If DNS resolution for zero.masscan.cloud fails, the worm falls back to a hardcoded IP at 94.154.172.43. In parallel, valid GitHub PATs are reused immediately to fork the contents of the victim's accessible repositories into attacker-controlled GitHub accounts. The new repositories are created with the description string 'A Mini Shai-Hulud has Appeared' and named using LAPSUS$/Dune-themed patterns: ghola-melange-*, mentat-melange-*, powindah-sietch-*. A separate dead-drop channel relies on GitHub's commit-search API — the worm pushes commits whose message embeds the keyword 'beautifulcastle' so the operator can locate freshly compromised repos via a single search query.
WORM PROPAGATION AND REPOSITORY POISONING
For every writable GitHub repo that a stolen PAT can reach, router_runtime.js plants .claude/setup.mjs, .claude/execution.js, .vscode/setup.mjs, and .vscode/tasks.json — a hardcoded impersonation of Anthropic's Claude Code agent and Visual Studio Code task automation that is intended to fire whenever a developer opens the repo in their IDE. The worm pushes its payload to up to 50 branches per repo to maximize survival under naive cleanup attempts. It also republishes any npm package the compromised PAT can publish to (with an incremented patch version), explaining the worm-class self-propagation behavior that gave the Shai-Hulud family its name.
ATTRIBUTION
Multiple vendors converge on TeamPCP, a threat group with documented overlap with LAPSUS$. Key evidence: (1) the embedded RSA exfil public key is byte-identical to keys recovered from prior Checkmarx and Bitwarden customer-targeting incidents; (2) the Russian-locale killswitch is implemented in the same way and at the same point in execution as in earlier TeamPCP samples; (3) reuse of the masscan.cloud namespace and the same GitHub-repo-as-dead-drop technique. The compromised maintainer GitHub account 'nhur' is being treated as a victim, not as the operator.
IMPACT
This is a CRITICAL software supply-chain incident affecting JavaScript, Python, and SAP/ERP build pipelines simultaneously. Any organization that ran npm install or pip install for the affected packages between roughly 14:00 and 14:47 UTC on 2026-04-30 should assume credential compromise of every secret reachable from that build host (cloud roles, container registry tokens, GitHub PATs, npm/PyPI publish tokens, Kubernetes service-account tokens, Vault tokens). Because stolen GitHub PATs are reused to plant payloads in *other* repositories, the blast radius extends well beyond the original install host: any private repo whose PAT touched a poisoned build is a candidate for further investigation.
MITRE ATT&CK techniques used in TL-2026-0446
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1480 Execution Guardrails
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1129 Shared Modules; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Persistence
T1098.001 Account Manipulation: Additional Cloud Credentials; T1546 Event Triggered Execution
Initial Access
T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores
Impact
Lateral Movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Resource Development
Affected products and versions in Mini Shai-Hulud Resurfaces
- Intercom — intercom-client (npm)
Vulnerable versions: 7.0.4
Fixed in: 7.0.5+ - SAP — @cap-js/sqlite (npm)
Vulnerable versions: 2.2.2
Fixed in: post-2.2.2 - SAP — @cap-js/postgres (npm)
Vulnerable versions: 2.2.2
Fixed in: post-2.2.2 - SAP — @cap-js/db-service (npm)
Vulnerable versions: 2.10.1
Fixed in: post-2.10.1 - SAP — mbt (Multi-Target Application Build Tool, npm)
Vulnerable versions: 1.2.48
Fixed in: post-1.2.48 - Lightning AI — lightning (PyPI / PyTorch Lightning)
Vulnerable versions: 2.6.2; 2.6.3
Fixed in: 2.6.1; 2.6.4+
Remediation for Mini Shai-Hulud Resurfaces
Patches
- intercom-client: upgrade to a known-clean version newer than 7.0.4 (registry maintainers unpublished 7.0.4 and republished a clean 7.0.5).
- PyTorch Lightning: pin to 2.6.1 or upgrade to 2.6.4+ once available; do not install 2.6.2 or 2.6.3.
- SAP CAP packages: upgrade past the affected versions per SAP's advisory (post-2.2.2 for @cap-js/sqlite/@cap-js/postgres, post-2.10.1 for @cap-js/db-service, post-1.2.48 for mbt).
Immediate actions
- Inventory every CI/CD runner, developer workstation, and container build host that ran npm install or pip install between 2026-04-30 13:30 and 15:00 UTC and quarantine the host until investigation completes.
- Pin and lock npm and PyPI manifests away from intercom-client@7.0.4, @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1, mbt@1.2.48, lightning==2.6.2, and lightning==2.6.3.
- Rotate every GitHub PAT, GitHub App installation token, npm token, PyPI token, AWS access key, GCP service-account key, Kubernetes kubeconfig token, and Vault token that any potentially-exposed host could reach.
- Block egress to zero.masscan.cloud and 94.154.172.43 at the firewall and DNS sinkhole.
- Audit GitHub for repositories with the description 'A Mini Shai-Hulud has Appeared' and for commits whose messages contain the keyword 'beautifulcastle'; revoke and rotate the maintainer's PAT immediately if any are found.
- Search every repo for unexpected .claude/setup.mjs, .claude/execution.js, .vscode/setup.mjs, and .vscode/tasks.json files and force-remove them across all branches.
Workarounds
- Set npm config ignore-scripts=true on all build hosts until package-level provenance can be verified.
- Use offline package mirrors / private registries seeded only with vetted artifacts during the active investigation window.
- Disable IMDSv1 on AWS and require IMDSv2 with hop-limit 1 to limit credential theft from build containers.
Longer-term hardening
- Mandate npm install --ignore-scripts in CI by default and explicitly allowlist packages that need lifecycle scripts.
- Move publishing tokens to short-lived OIDC trust (npm provenance, PyPI Trusted Publishers, GitHub Actions OIDC) and disable long-lived classic PATs entirely.
- Require 2FA enforcement and hardware-key login for all npm and PyPI maintainer accounts associated with packages your organization depends on; subscribe to package-takeover alerts from Socket, Snyk, or equivalent.
- Run all builds in ephemeral, network-segmented runners with no IMDS access and no developer-secret mounts; deny-by-default egress with allowlisting.
- Deploy SBOM + dependency-pinning policy with hash-pinned lockfiles and reproducible builds verification.
Weaknesses (CWE) in Mini Shai-Hulud Resurfaces
CWE-506, CWE-829, CWE-494, CWE-1357
Timeline of Mini Shai-Hulud Resurfaces
- Original Shai-Hulud npm worm first observed in the wild, establishing the self-propagating package-takeover playbook later reused by Mini Shai-Hulud.
- Shai-Hulud 2.0 emerges with improved obfuscation and broader credential-harvesting scope, attributed by multiple vendors to the same operators.
- Threadlinqs Intelligence publishes TL-2026-0446 with full MITRE mapping, IOCs, detection coverage, and attack simulations.
- Hashes for setup.mjs and router_runtime.js, the C2 domain zero.masscan.cloud, fallback IP 94.154.172.43, the GitHub repo description signature, and the 'beautifulcastle' commit-search keyword published as IOCs.
- npm and PyPI unpublish the malicious package versions; clean follow-on releases (intercom-client 7.0.5) issued.
- Socket, Wiz, OX Security, and The Hacker News publish coordinated advisories naming TeamPCP (LAPSUS$ overlap) as the attributed actor.
- intercom-client@7.0.4 published to npm with malicious setup.mjs preinstall hook and embedded router_runtime.js (~11.7 MB obfuscated). Active install window estimated by Socket at ~47 minutes.
- Mini Shai-Hulud campaign begins; attackers publish trojanized versions of intercom-client, four SAP CAP/MBT npm packages, and PyTorch Lightning 2.6.2/2.6.3 to PyPI within a coordinated window.
- As of 2026-05-29, the specific vectors (intercom-client 7.0.4, lightning 2.6.2/2.6.3, SAP pkgs) were unpublished with clean releases, but the TeamPCP Mini Shai-Hulud worm remains a live concern: it hit TanStack May 11, went open-source May 12, and ran its largest wave (639 versions) May 19. No arrests or takedown.
Sources cited for Mini Shai-Hulud Resurfaces
- Intercom's npm Package Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack
- Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware
- PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials
- 8.3M Downloads Compromised: Lightning & Intercom-Client Infected in Latest Shai-Hulud Attack
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain: Software Dependencies and Development Tools
- MITRE ATT&CK T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- MITRE ATT&CK T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Threats related to Mini Shai-Hulud Resurfaces
- SAP CAP & Cloud MTA npm Packages Compromised — Mini Shai-Hulud (TeamPCP) Bun-Based Credential Stealer
- lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)
- StepSecurity Dev Machine Guard adds fleet-wide developer credential inventory to close blind spot exploited by supply-chain attacks
- Miasma Worm Compromises 73 Microsoft GitHub Repositories Across Azure, Azure-Samples, Microsoft & MicrosoftDocs — Self-Replicating Mini Shai-Hulud Variant Weaponizing AI Coding Agents (TeamPCP)
- Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
- Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2 infrastructure
Detection coverage for TL-2026-0446
As of 2026-04-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0446 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.