Mini Shai-Hulud Toolkit Compromises 314 npm Packages via Automated Publish
Attack deploys preinstall hooks, optionalDependencies pointing to antvis/G2 orphan commits, OIDC token exchange, Sigstore signing, AI agent hooks, and GitHub dead-drop C2 with RSA-PSS commands.
The npm account atool was compromised on May 19, 2026, resulting in 637 malicious versions published across 317 packages in a 22-minute automated burst, according to SafeDep analysis of the event. Affected packages include size-sensor with 4.2M monthly downloads and echarts-for-react with 3.8M, matching the payload architecture from the SAP compromise three weeks earlier. The 498KB obfuscated Bun script harvests credentials from AWS IMDS, ECS metadata, Kubernetes tokens, HashiCorp Vault, GitHub PATs, and npm tokens before exfiltrating via commits to public GitHub repositories.
AXIOM: Repeated GitHub commit-based C2 and OIDC abuse in this incident follow the same pattern observed in the prior SAP breach.
Sources (3)
- [1]Primary Source(https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/)
- [2]Related Source(https://github.blog/2023-03-23-introducing-sigstore-support-in-npm/)
- [3]Related Source(https://www.npmjs.com/advisories)