A sophisticated supply chain worm swept through the npm ecosystem on May 19, 2026, compromising at least 633 malicious package versions across hundreds of packages in under an hour, for the first time.
Endor Labs first detected the campaign at 01:39 UTC when jest-canvas-mock@2.5.3 was published, followed five minutes later by size-sensor@1.0.4.
Both packages had been dormant for three years. By 02:06 UTC, the worm had published 42 confirmed malicious packages.
Socket’s independent analysis later raised the total to 639 compromised versions across 323 unique packages in this single wave alone, spanning the @antv namespace, @lint-md, @openclaw-cn, @starmind, and dozens of unscoped packages including echarts-for-react, timeago.js, and canvas-nest.js.
600+ npm Packages Compromised
Across the full Mini Shai-Hulud campaign lifecycle, Socket has now tracked 1,055 versions across 502 unique packages spanning npm, PyPI, and Composer. The campaign used two distinct but coordinated infection vectors.
The first, a phantom commit dropper, targeted jest-canvas-mock and size-sensor. These otherwise clean packages received a single change: an optionalDependencies entry pointing to raw GitHub commit hashes, resolving to a malicious @antv/setup dependency hosted on forks of the antvis/G2 repository.
The dependency’s prepare hook ran an obfuscated Bun payload, then exited with exit 1. Because the dependency was optional, npm silently ignored the failure during install, even though the payload had already executed.
The second mechanism involved an embedded payload injected directly into 40+ propagated packages. A ~500KB obfuscated index.js was placed at the package root with a preinstall hook executing it automatically during npm install.
"preinstall": "bun run index.js" SHA-256 of the @antv/l7-core payload: a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c.
The most significant development in this wave is the worm’s ability to generate cryptographically valid Sigstore provenance attestations for every package it publishes.
Using an ephemeral EC key pair, the payload mints OIDC identity tokens from the compromised CI runner’s environment, submits them to Fulcio for signing, and logs entries to the Rekor transparency log, assembling a complete.
The result: packages published by this worm display a green provenance badge and pass all standard verification checks. The certificate subject reflects a legitimate CI identity.
Only the authorization was never granted. Standard provenance tooling cannot distinguish these packages from legitimate releases.
The payload daemonizes itself immediately using a __DAEMONIZED re-entrancy guard, detaching from the npm install process so the install exits normally while the implant continues running in the background.
Harvested credentials include GitHub tokens, npm tokens, AWS IAM keys (via IMDSv2 at 169.254.169.254 and ECS metadata at 169.254.170.2 across 17 regions), GCP service account keys, HashiCorp Vault tokens, Kubernetes service account material, and GitHub Actions OIDC tokens minted at runtime.
Primary exfiltration routes to filev2.getsession[.]org/file/ over Session P2P on TCP/443 encrypted traffic indistinguishable from legitimate app traffic.
A GitHub fallback mechanism can create repositories under the victim’s account, committing stolen data to a results/ directory, said Socket.
Roughly 1,900 threat actor repositories using the reversed marker niagA oG eW ereH :duluH-iahS are currently visible in GitHub search, according to EndorLabs, confirming the fallback path is operational at scale.
Persistence artifacts written outside node_modules survive package removal: .claude/settings.json (SessionStart hook) and .vscode/tasks.json (runOn: folderOpen).
Indicators of Compromise
| Indicator | Type | Notes |
|---|---|---|
filev2.getsession[.]org/file/ | Network | Primary exfiltration, TCP/443 |
github:antvis/G2#1916faa365f2788b6e193514872d51a242876569 | Dependency | Phantom commit — jest-canvas-mock@2.5.3 |
github:antvis/G2#7cb42f57561c321ecb09b4552802ae0ac55b3a7a | Dependency | Phantom commit — size-sensor@1.0.4 |
@antv/setup in optionalDependencies | Registry | Should not exist in any legitimate package |
__DAEMONIZED in payload | Code marker | Re-entrancy guard across all family variants |
169.254.169.254 / 169.254.170.2 | Network | AWS IMDSv2 / ECS metadata harvesting |
.claude/settings.json, .vscode/tasks.json | File | Persistence hooks surviving package removal |
https://t[.]m-kosche[.]com:443/api/public/otel/v1/traces | Network | Secondary C2 endpoint (Socket analysis) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Mitigation:
- If you installed any affected package on May 19, rotate all credentials immediately — npm tokens, GitHub PATs, AWS IAM keys, GCP keys, Vault tokens, and SSH keys
- Run
npm ci --ignore-scriptsin all CI builds to suppress lifecycle hook execution - Hunt for phantom commit hashes in your lockfile and check for
.claude/settings.jsonand.vscode/tasks.jsonpersistence artifacts - Block outbound traffic to
filev2.getsession[.]organd audit recent network flows - Search Rekor for unexpected Fulcio certificate issuances under your organization’s CI identities.
- Do not treat a valid Sigstore provenance badge as proof of legitimacy. This campaign’s packages pass all provenance verification checks.
Endor Labs and Socket are both continuing to monitor the campaign. The full list of affected package versions is being updated in real time on both platforms.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
