TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise

TeamPCP @antv Supply Chain Wave (TL-2026-0530), also tracked as Mini Shai-Hulud, is a critical-severity supply-chain compromise, first published 2026-05-19. It is attributed to TeamPCP with medium confidence, affects AntV (Ant Group) @antv npm namespace, maps to 34 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-0530

Threat ID
TL-2026-0530
Also known as
Mini Shai-Hulud, TeamPCP @antv Wave, Shai-Hulud: Here We Go Again, antv supply chain attack
Severity
CRITICAL
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-05-19
Last reviewed
2026-05-19
Attribution
TeamPCP
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development, open-source, financial-services, ai-ml, data-analytics, fintech, consulting
Target regions
Global, North America, Europe, Asia-Pacific, China
Detection rules
9
Indicators of compromise
27

Malware and tooling in TeamPCP @antv Supply Chain Wave

Malware and tooling: Shai-Hulud, bun

Coordinated multi-ecosystem supply chain compromise (May 19, 2026) attributed by Wiz Research to TeamPCP — backdoors 200+ @antv npm packages, the actions-cool/maintain-one-comment and actions-cool/issues-helper GitHub Actions, and nrwl.angular-console v18.95.0 VSCode extension. Multi-stage infection retrieves payloads from orphaned GitHub commits, uses bun to install secondary payloads, harvests GitHub tokens/SSH keys/cloud credentials/browser secrets, and exfiltrates via attacker-created public GitHub repositories (description marker 'niagA oG eW ereH :duluH-iahS'). Persistence via Python backdoor at ~/.local/share/kitty/cat.py polling api.github.com for commits containing the C2 trigger string 'firedalazer'; backup C2 at m-kosche.com (185.95.159.32). Reuses Shai-Hulud family TTPs.

How TeamPCP @antv Supply Chain Wave works

The TeamPCP @antv Supply Chain Wave (aka "Mini Shai-Hulud") is a coordinated, multi-ecosystem software supply chain compromise that reemerged on May 19, 2026, simultaneously affecting npm packages in the @antv visualization namespace, two widely-used actions-cool GitHub Actions (actions-cool/maintain-one-comment, actions-cool/issues-helper), and the nrwl.angular-console v18.95.0 VSCode extension. Wiz Research attributes the campaign with moderate confidence to the threat actor TeamPCP based on infrastructure overlaps, malware functionality, operational patterns, and tradecraft consistent with prior Shai-Hulud-family activity.

The infection begins when a developer or CI runner installs a compromised @antv npm package (200+ packages were published with malicious versions, e.g., @antv/g2 5.5.8/5.6.8, @antv/g6 5.2.1/5.3.1, @antv/util 3.4.11/3.5.11), executes a compromised GitHub Action workflow step, or activates the trojanized nrwl.angular-console v18.95.0 extension. Postinstall (or Action) code reaches out to GitHub-hosted infrastructure to retrieve additional payloads. Many of those payloads were stashed in orphaned GitHub commits, a deliberate evasion technique that decouples the malicious blob from any branch ref while keeping it reachable by commit SHA — the commit survives even if the repository is later cleaned.

Once the bootstrap stage runs, the malware uses `bun` (a fast JavaScript runtime/installer) to fetch and execute secondary payloads responsible for credential theft and persistence. The credential-stealing stage harvests a broad set of developer secrets: GitHub personal access tokens (from gh CLI, npm `.npmrc`, environment variables), SSH private keys (`~/.ssh/`), cloud provider credentials (AWS `~/.aws/credentials`, GCP application-default credentials, Azure CLI tokens), and browser-stored secrets (Chromium login data, cookies). Exfiltration is achieved by creating attacker-controlled **public** GitHub repositories from the victim's account and uploading the stolen data — repositories are tagged with the distinctive description string `niagA oG eW ereH :duluH-iahS` (the phrase "Shai-Hulud: Here We Go Again" reversed).

Persistence is established by dropping a Python backdoor at `~/.local/share/kitty/cat.py` (the "kitty" path masquerades as the Kitty terminal emulator's data directory). On macOS, persistence is anchored with a LaunchAgent plist at `~/Library/LaunchAgents/com.user.kitty-monitor.plist`; on Linux, with a systemd user unit at `~/.config/systemd/user/kitty-monitor.service`. The backdoor periodically polls the GitHub API endpoint `api.github.com/search/commits?q=firedalazer` looking for commits containing the C2 trigger string `firedalazer`. When a valid signed instruction is identified, the backdoor fetches and executes remote Python code, granting the operator ongoing arbitrary code execution. A fallback C2 channel is provided by the domain `m-kosche.com` (185.95.159.32). At time of disclosure Wiz had not observed the C2 channel active, suggesting the operators were in the staging phase.

The backdoor binary (cat.py / packaged blob) carries the following hashes: MD5 b06b126b9e26af03a7ef2f8b8e90d446 / SHA-1 783b4019fc5b942a29846132d28441c8fc31bed8 / SHA-256 fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142.

Impact is severe because the affected components target high-trust environments: developer workstations (where local SSH keys and cloud credentials live), GitHub Actions runners (where repository write tokens and cloud OIDC trust live), and the @antv ecosystem (high-traffic data visualization libraries with deep transitive dependency reach — @antv/g2 and @antv/g6 alone are dependencies of thousands of downstream projects, including AI/ML dashboards using @antv/mcp-server-chart). Any organization that built, tested, or deployed an affected package version on May 19, 2026 must assume token, key, and credential compromise.

This wave is a continuation of the broader Shai-Hulud worm family of self-propagating npm supply chain attacks (originally documented in 2025 with the s1ngularity-repository pattern). TeamPCP's tradecraft reuses orphaned-commit payload hosting, GitHub-as-C2, and credential-harvest-then-republish propagation seen in earlier waves, but with a tighter focus on a single high-value npm namespace plus CI Actions and IDE extensions for broader developer reach. Recommended response is immediate: pin/remove affected versions, rotate ALL developer and CI secrets, audit repositories for unauthorized public repos with the marker description, hunt for the cat.py persistence file and the LaunchAgent/systemd units, and block egress to api.github.com search endpoints querying for `firedalazer` and to m-kosche.com / 185.95.159.32.

MITRE ATT&CK techniques used in TL-2026-0530

Collection

T1005 Data from Local System

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1102 Web Service; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053.003 Cron; T1543.001 Launch Agent; T1543.002 Systemd Service

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.006 Python; T1204 User Execution

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1526 Cloud Service Discovery

Initial Access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Impact

T1496 Resource Hijacking

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities

Affected products and versions in TeamPCP @antv Supply Chain Wave

  • AntV (Ant Group) — @antv npm namespace
    Vulnerable versions: 200+ packages published 2026-05-19 — see Wiz appendix; e.g., @antv/g2 5.5.8/5.6.8, @antv/g6 5.2.1/5.3.1, @antv/util 3.4.11/3.5.11, @antv/g 6.4.1/6.5.1, @antv/component 2.2.11/2.3.11
    Fixed in: Last prior published version of each package (downgrade required); ecosystem republish in progress
  • actions-cool — actions-cool/maintain-one-comment (GitHub Action)
    Vulnerable versions: All tags during compromise window 2026-05-19
    Fixed in: Commit SHA prior to 2026-05-19
  • actions-cool — actions-cool/issues-helper (GitHub Action)
    Vulnerable versions: All tags during compromise window 2026-05-19
    Fixed in: Commit SHA prior to 2026-05-19
  • Nrwl — nrwl.angular-console (VSCode extension)
    Vulnerable versions: 18.95.0
    Fixed in: 18.94.x or post-incident >= 18.96.0

Remediation for TeamPCP @antv Supply Chain Wave

Patches

  • Affected @antv packages: downgrade to last clean version per Wiz appendix (each compromised package has a clean prior version; e.g., @antv/g2 < 5.5.8).
  • actions-cool/maintain-one-comment and actions-cool/issues-helper: pin to commit SHA prior to 2026-05-19 publication.
  • nrwl.angular-console: upgrade to post-incident clean release (>= 18.96.0) or downgrade to 18.94.x.

Immediate actions

  • Audit package-lock.json / yarn.lock / pnpm-lock.yaml for any @antv package with a publish date of 2026-05-19; remove and pin to a known-good prior version.
  • Remove or pin actions-cool/maintain-one-comment and actions-cool/issues-helper to a commit SHA published before 2026-05-19 (not a floating tag).
  • Uninstall nrwl.angular-console v18.95.0 from every developer workstation; replace with 18.94.x or 18.96.x (post-incident clean release).
  • Rotate ALL GitHub personal access tokens (gh CLI, npm publish tokens, CI tokens) for any developer or runner that executed affected packages or workflows on/after 2026-05-19.
  • Rotate SSH private keys in ~/.ssh/ for any developer who ran an affected package.
  • Rotate cloud credentials: AWS access keys (~/.aws/credentials), GCP application-default credentials, Azure CLI tokens.
  • Audit the victim GitHub account(s) for newly created PUBLIC repositories with the description string 'niagA oG eW ereH :duluH-iahS' and delete them after preserving forensic copies.
  • Hunt for and remove ~/.local/share/kitty/cat.py on all developer workstations and CI runners.
  • Disable / unload persistence units: ~/Library/LaunchAgents/com.user.kitty-monitor.plist (macOS) and ~/.config/systemd/user/kitty-monitor.service (Linux).

Workarounds

  • Set 'ignore-scripts=true' in .npmrc for all dev and CI environments until ecosystem is confirmed clean.
  • Block egress from CI runners to api.github.com search endpoints (api.github.com/search/commits) at the network layer.
  • Block egress to m-kosche.com and 185.95.159.32 at perimeter and host firewall.
  • Add detection rule for repository creation events with description containing 'niagA oG eW ereH :duluH-iahS' or 'Shai-Hulud'.

Longer-term hardening

  • Implement dependency allowlisting (npm install --ignore-scripts as default; explicit allowlist for packages that require lifecycle scripts).
  • Enforce SBOM generation in CI (Syft / Anchore) and diff SBOMs across builds to detect new dependencies pulled in by typosquats or version bumps.
  • Adopt npm package provenance / Sigstore attestations and reject packages without valid provenance for security-sensitive namespaces.
  • Pin GitHub Actions to immutable commit SHAs, not tags or branches; use Dependabot to track Action SHA updates.
  • Deploy EDR with behavioral detection on developer workstations — flag postinstall script spawning bun/curl/wget reaching api.github.com or unknown hosts.
  • Network egress allowlisting on CI runners — block all outbound except registry, source repo, and explicitly allowed artifact destinations.
  • Adopt short-lived, OIDC-federated cloud credentials in CI in place of long-lived access keys.
  • Continuous monitoring of org-wide GitHub events for repository creation, especially with anomalous descriptions or by service accounts.

Weaknesses (CWE) in TeamPCP @antv Supply Chain Wave

CWE-506, CWE-829, CWE-494, CWE-522, CWE-912

Timeline of TeamPCP @antv Supply Chain Wave

  • Original Shai-Hulud npm supply chain worm publicly disclosed by Wiz, Socket, and StepSecurity — established TTP family (orphaned-commit payload hosting, GitHub-as-C2, self-propagating credential harvest).
  • Attacker stages payloads in orphaned GitHub commits and prepares backup C2 infrastructure at m-kosche.com (185.95.159.32) ahead of mass publish.
  • Wiz notes that as of disclosure the C2 polling for 'firedalazer' commits had not been observed to return active commands — operators appeared to still be in staging.
  • AntV maintainers, npm, GitHub Marketplace, and VSCode Marketplace begin coordinated package removal and tag-overwrite reversal. Nrwl/Nx issues impact report for angular-console 18.95.0.
  • Full IOC set published: cat.py backdoor hashes (SHA-256 fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142), C2 trigger string 'firedalazer', GitHub API polling endpoint, fallback C2 m-kosche.com / 185.95.159.32, persistence paths.
  • Wiz Research publishes 'The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave' attributing the campaign with moderate confidence to TeamPCP based on infrastructure overlaps, malware functionality, and operational patterns.
  • Wiz Research observes related malicious activity in real time across developer and CI/CD environments — postinstall scripts spawning bun, fetching secondary payloads, and creating public exfil repos with description 'niagA oG eW ereH :duluH-iahS'.
  • Coordinated mass-publish: 200+ malicious @antv npm package versions, actions-cool/maintain-one-comment and actions-cool/issues-helper GitHub Action tag overwrites, and nrwl.angular-console v18.95.0 VSCode extension all push compromised builds within hours.
  • As of 2026-05-29, this specific @antv wave is largely contained — GitHub/npm pulled ~640 malicious packages and npm invalidated 61,274 2FA-bypass tokens — but TeamPCP's self-propagating Mini Shai-Hulud worm remains active in the wild with recurring waves and survives package removal. Treat as MONITORING: vector neutralized, actor/tooling persists and could resurge.

Sources cited for TeamPCP @antv Supply Chain Wave

Threats related to TeamPCP @antv Supply Chain Wave

Detection coverage for TL-2026-0530

As of 2026-05-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0530 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats