# Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)

> On 2026-05-19 a compromised maintainer account ('atool') published 637-639 malicious versions across ~323 npm packages in the @antv ecosystem, including echarts-for-react, size-sensor and timeago.js. A preinstall hook runs an obfuscated Bun payload that harvests cloud, GitHub, npm, Vault, Kubernetes and 1Password credentials from workstations and GitHub Actions runners, then self-propagates. Qualys and GBHackers (2026-09-28/30) frame it as attackers moving beyond source-code theft to developer credentials for cloud account takeover.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2806
- **ID:** TL-2026-2806
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Mini Shai-Hulud is a fifth-wave continuation of the Shai-Hulud npm worm lineage (Sep 2025 original, Nov 2025 'SHA1-Hulud', Apr 2026 SAP CAP-JS wave with Claude Code hook injection, 2026-05-11 TanStack wave with valid SLSA provenance via OIDC hijack). On 2026-05-19 UTC, in two waves (about 01:39-01:56 with ~317 versions and 02:05-02:06 with ~314 versions), the npm account 'atool', which maintains the @antv scope and roughly 547 packages, was used to publish malicious versions. Snyk counts 637 versions across 323 packages and about 16 million weekly downloads; Microsoft and SecurityWeek count 639 versions. Downstream packages such as echarts-for-react (over 1M weekly downloads), size-sensor and timeago.js were affected. The method of maintainer-account compromise was still under investigation.

Execution chain: the package's preinstall hook runs node, then a shell, then Bun (installed if absent), then a ~499 KB obfuscated index.js that replaces the legitimate file. Obfuscation has two layers: 1,732 Base64 strings in a rotated array (shuffle key 0xa31de), and PBKDF2/SHA-256-encrypted critical strings (C2 domain, env var names) decrypted at runtime. The payload gates on GitHub Actions on Linux and skips main, master, dependabot/, renovate/ and gh-pages branches. It reads secrets from the Runner.Worker process memory (/proc/<pid>/mem), which bypasses GitHub secret masking. It also probes AWS IMDS (169.254.169.254) and ECS (169.254.170.2) metadata, and scans 80+ environment variables and 100-130+ file paths (~/.aws/credentials, ~/.kube/config, .npmrc, .netrc, Vault token paths, SSH keys, database strings, SaaS tokens). Targeted credential stores include GitHub, AWS, GCP, Azure, HashiCorp Vault, Kubernetes, npm (including OIDC-to-npm token exchange) and 1Password.

Exfiltration: data is JSON-serialized, gzip-compressed and AES-256-GCM encrypted with the key wrapped by an attacker RSA-OAEP public key. It goes to t.m-kosche[.]com:443 at /api/public/otel/v1/traces, disguised as OpenTelemetry traces. The fallback is public GitHub 'dead-drop' repositories created under victim accounts (2,200+ observed) with the reversed description 'niagA oG eW ereH :duluH-iahS' and Dune-themed names, plus commits through the Git Data API. Persistence and escalation: an injected passwordless sudoers rule, a .claude/settings.json SessionStart hook, a .vscode/tasks.json folderOpen task, a Python C2 daemon (~/.local/share/kitty/cat.py) run through a systemd user unit or macOS LaunchAgent, and a GitHub token monitor. The payload also forges Sigstore (Fulcio/Rekor) SLSA provenance and injects a malicious GitHub workflow. Attribution to TeamPCP (DeadCatx3, PCPcat) comes from Snyk and SecurityWeek citing researchers. Microsoft did not name an actor.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1078.004 Cloud Accounts
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1543.002 Systemd Service
- T1543.001 Launch Agent
- T1548.003 Sudo and Sudo Caching
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1003.007 Proc Filesystem
- T1528 Steal Application Access Token
- T1071.001 Web Protocols
- T1567.001 Exfiltration to Code Repository

## Sources

- [Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code](https://gbhackers.com/supply-chain-intrusions/)
- [Qualys: Developer New Perimeter Supply Chain Cloud Breaches](https://blog.qualys.com/vulnerabilities-threat-research/2026/09/28/developer-new-perimeter-supply-chain-cloud-breaches)
- [Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/)
- [Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account (Snyk)](https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/)
- [Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack (SecurityWeek)](https://www.securityweek.com/over-320-npm-packages-hit-by-fresh-mini-shai-hulud-supply-chain-attack/)
- [Mini Shai-Hulud Hits @antv npm Packages, Targets CI/CD Secrets (GBHackers)](https://gbhackers.com/antv-npm-packages/)
- [Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack (Microsoft)](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)
- [Mini Shai-Hulud Compromises @antv npm Packages to Steal CI/CD Credentials (Cybersecuritynews)](https://cybersecuritynews.com/mini-shai-hulud-compromises-antv-npm-packages-to-steal-ci-cd-credentials/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2806