TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise — Threadlinqs Intelligence
As of 2026-05-30, TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0530 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
Coordinated multi-ecosystem supply chain compromise (May 19, 2026) attributed by Wiz Research to TeamPCP — backdoors 200+ @antv npm packages, the actions-cool/maintain-one-comment and
The TeamPCP @antv Supply Chain Wave (aka "Mini Shai-Hulud") is a coordinated, multi-ecosystem software supply chain compromise that reemerged on May 19, 2026, simultaneously affecting npm packages in the @antv visualization namespace, two widely-used actions-cool GitHub Actions (actions-cool/maintain-one-comment, actions-cool/issues-helper), and the nrwl.angular-console v18.95.0 VSCode extension. Wiz Research attributes the campaign with moderate confidence to the threat actor TeamPCP based on infrastructure overlaps, malware functionality, operational patterns, and tradecraft consistent with prior Shai-Hulud-family activity.
The infection begins when a developer or CI runner installs a compromised @antv npm package (200+ packages were published with malicious versions, e.g., @antv/g2 5.5.8/5.6.8, @antv/g6 5.2.1/5.3.1, @antv/util 3.4.11/3.5.11), executes a compromised GitHub Action workflow step, or activates the trojanized nrwl.angular-console v18.95.0 extension. Postinstall (or Action) code reaches out to GitHub-hosted infrastructure to retrieve additional payloads. Many of those payloads were stashed in orphaned GitHub commits, a deliberate evasion technique that decouples the malicious blob from any branch ref while keeping it reachable by commit SHA — the commit survives even if the repository is later cleaned.
Once the bootstrap stage runs, the malware uses `bun` (a fast JavaScript runtime/installer) to fetch and execute secondary payloads responsible for credential theft and persistence. The credential-stealing stage harvests a broad set of developer secrets: GitHub personal access tokens (from gh CLI, npm `.npmrc`, environment variables), SSH private keys (`~/.ssh/`), cloud provider credentials (AWS `~/.aws/credentials`, GCP application-default credentials, Azure CLI tokens), and browser-stored secrets (Chromium login data, cookies). Exfiltration is achieved by creating attacker-controlled **public** GitHub repositories from the victim's account and uploading the stolen data — repositories are tagged with the distinctive description string `niagA oG eW ereH :duluH-iahS` (the phrase "Shai-Hulud: Here We Go Again" reversed).
Persistence is established by dropping a Python backdoor at `~/.local/share/kitty/cat.py` (the "kitty" path masquerades as the Kitty terminal emulator's data directory). On macOS, persistence is anchored with a LaunchAgent plist at `~/Library/LaunchAgents/com.user.kitty-monitor.plist`; on Linux, with a systemd user unit at `~/.config/systemd/user/kitty-monitor.service`. The backdoor periodically polls the GitHub API endpoint `api.github.com/search/commits?q=firedalazer` looking for commits containing the C2 trigger string `firedalazer`. When a valid signed instruction is identified, the backdoor fetches and executes remote Python code, granting the operator ongoing arbitrary code execution. A fallback C2 channel is provided by the domain `m-kosche.com` (185.95.159.32). At time of disclosure Wiz had not observed the C2 channel active, suggesting the operators were in the staging phase.
The backdoor binary (cat.py / packaged blob) carries the following hashes: MD5 b06b126b9e26af03a7ef2f8b8e90d446 / SHA-1 783b4019fc5b942a29846132d28441c8fc31bed8 / SHA-256 fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142.
Impact is severe because the affected components target high-trust environments: developer workstations (where local SSH keys and cloud credentials live), GitHub Actions runners (where repository write tokens and cloud OIDC trust live), and the @antv ecosystem (high-traffic data visualization libraries with deep transitive dependency reach — @antv/g2 and @antv/g6 alone are dependencies of thousands of downstream projects, including AI/ML dashboards using @antv/mcp-server-chart). Any organization that built, tested, or deployed an affected package version on May 19, 2026 must assume token, key, and credential compromise.
This wave is a continuation of the broader Shai-Hulud worm fam
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-522, CWE-912
Target sectors: technology, software-development, open-source, financial-services, ai-ml, data-analytics, fintech, consulting
Target regions: Global, North America, Europe, Asia-Pacific, China
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1583, T1608, T1587, T1195, T1195.002, T1199, T1059, T1059.006, T1059.004