Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in @antstackio/shelbysam (npm)

The npm package @antstackio/shelbysam was compromised and contained malicious code associated with the Sha1-Hulud: The Second Coming NPM worm. The malicious payload steals tokens and credentials, publishes them to GitHub, propagates to other NPM packages owned by the user, and may destroy the user's home directory.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Users of @antstackio/shelbysam package; downstream projects depending on this package; GitHub accounts and repositories of affected developers
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Threat actor
Shai-Hulud
Affected entities
  • @antstackio/shelbysamnpm package containing malicious code

The npm package @antstackio/shelbysam was found to contain malicious code, as identified by both Amazon Inspector and Google Open Source Security scanning.

The package was compromised by the Sha1-Hulud: The Second Coming NPM worm. The malicious payload performs multiple destructive actions: it steals tokens and credentials and publishes them to GitHub, propagates itself to NPM packages owned by the affected user, and establishes persistence through a GitHub action. The worm may also destroy the user's home directory.

This incident was documented by the OpenSSF in their malicious-packages repository (MAL-2025-191191), indicating coordinated detection and tracking of the threat.

Users who installed affected versions of @antstackio/shelbysam are at risk of credential theft, account compromise, and lateral movement to other projects and repositories.

Indicators of compromise

Packages
  • @antstackio/shelbysam

Remediation

  • Immediately remove @antstackio/shelbysam from all projects and dependencies
  • Rotate all tokens, credentials, and secrets that may have been exposed
  • Audit GitHub accounts and repositories for unauthorized actions or commits
  • Review GitHub Actions workflows for suspicious additions or modifications
  • Scan systems for signs of home directory destruction or data loss
  • Check npm account for unauthorized package publications or modifications
  • Review npm package publishing logs for suspicious activity
  • Update all dependencies to remove transitive dependencies on @antstackio/shelbysam

Sources

  1. GitHub Advisory GHSA-j7v3-xxhh-942f · GitHub Advisory Database

Cite this entry

"Malicious code in @antstackio/shelbysam (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 26, 2026; last updated July 26, 2026. https://supplychainattack.org/incident/malicious-code-in-antstackio-shelbysam-npm-1tqwif

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in @antv/f-wx (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 packages, including @antv/f-wx. Each version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials via the GitHub API and establishes persistence through CI/CD workflow injection and system daemons.

    Mini Shai HuludTeamPCPnpmOtherAccount takeoverCompromised packageMalicious commit
  2. containedcritical

    Malicious code in @antv/g-web-components (npm)

    A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages in a 22-minute automated burst, including @antv/g-web-components. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit
  3. containedcritical

    Malicious code in @antv/dipper-hooks (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/dipper-hooks, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials (AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes tokens, SSH keys, Docker configs, database strings, Stripe keys, Slack tokens) via the GitHub API and establishes persistence through CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit
  4. containedcritical

    Malicious code in @antv/g-plugin-physx (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-plugin-physx, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials (AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes tokens, SSH keys, Docker configs, database strings, Stripe keys, Slack tokens) via the GitHub API and establishes persistence through CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit