Malicious code in @antv/f2-canvas (npm)

A threat actor compromised the npm account atool and executed an automated attack publishing 631 malicious versions across 314 npm packages in a 22-minute burst. The @antv/f2-canvas package was among those affected, modified to include a malicious preinstall hook.\n\nEach malicious version executes a 498KB obfuscated Bun script that exfiltrates sensitive credentials including AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker auth configs, database connection strings, Stripe keys, and Slack tokens. The script uses the GitHub API as a covert exfiltration channel, committing stolen data to attacker-controlled repositories following Dune-themed naming patterns (e.g., harkonnen-melange-742).\n\nThe attack establishes multiple persistence mechanisms: CI/CD workflow injection via a GitHub Actions workflow named Run Copilot that dumps all secrets, AI agent session hooks, and a system daemon named kitty-monitor. This incident is part of the ongoing "Mini Shai-Hulud" worm campaign attributed to the TeamPCP threat actor.\n\nThe compromise was detected by multiple security sources including Amazon Inspector and Google Open Source Security.