Mini Shai-Hulud Malware Targets @antv Packages To Harvest CI/CD Secrets

Microsoft researchers have uncovered an active supply chain attack targeting the popular @antv Node Package Manager (npm) ecosystem.

Threat actors compromised a maintainer account to distribute the “Mini Shai-Hulud” malware via widely used data visualization libraries.

This breach caused massive downstream impacts, infecting libraries like echarts-for-react, which averages over one million weekly downloads.

The malicious payload consists of a 499 KB obfuscated JavaScript file that executes silently during the npm install process.

Designed specifically to target Continuous Integration and Continuous Deployment (CI/CD) pipelines, the malware aggressively harvests credentials from GitHub Actions environments and cloud workloads.

GitHub acted quickly, removing 640 malicious packages and invalidating over 61,000 npm tokens to prevent further damage. The @antv maintainers have also confirmed the repository is now secure.

Mini Shai-Hulud Steals Secrets

The attack begins when developers install compromised versions of the @antv package, triggering a malicious preinstall hook. This action executes a complex chain that eventually runs the obfuscated payload.

To evade detection, the malware uses a two-layer obfuscation technique that involves a Base64-encoded rotated array and runtime decryption via a custom PBKDF2 cipher.

The script includes strict environment gating, meaning it immediately terminates if it does not detect a GitHub Actions Linux runner.

Once active, the malware hunts for high-value secrets across multiple platforms:

• GitHub: Extracts installation tokens and personal access tokens during repository secret enumeration.
• Amazon Web Services: Queries metadata services and extracts environment variables to call AWS Secrets Manager across all regions.
• HashiCorp Vault: Scours local systems for tokens across more than a dozen file paths.
• Kubernetes: Reads service account tokens to enumerate namespace secrets.
• 1Password: Interacts with the command-line interface to bypass two-factor authentication and steal master passwords.

According to Microsoft research, the malware scrapes the memory of the GitHub Actions runner process to bypass standard secret masking.

It also escalates privileges by injecting passwordless sudo rules and manipulating DNS settings.

Stolen data is then exfiltrated via HTTPS to a primary command-and-control server, with a fallback mechanism that uses the Git Data API to hide it within victim repositories.

Security teams should implement the following mitigation strategies immediately:

• Review dependency trees for direct or transitive usage of affected @antv packages.
• Disable pre-installation and post-installation script execution by running package installations with the –ignore-scripts flag.
• Pin known-good package versions and pause automatic dependency upgrades until thorough validation is complete.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.