Malicious code in @antv/g6-cli (npm)

A threat actor compromised the npm account atool and executed a coordinated supply chain attack dubbed "Mini Shai-Hulud," publishing 631 malicious versions across 314 npm packages in a 22-minute automated burst. The @antv/g6-cli package was among those compromised.\n\nEach malicious version injects a preinstall hook that executes a 498KB obfuscated Bun script. This script uses the GitHub API as a covert exfiltration channel to steal sensitive credentials, including AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker authentication configs, database connection strings, Stripe keys, and Slack tokens. Stolen credentials are committed to attacker-controlled repositories following Dune-themed naming patterns (e.g., harkonnen-melange-742).\n\nBeyond credential theft, the malicious code establishes multiple persistence mechanisms: CI/CD workflow injection (a GitHub Actions workflow named Run Copilot that dumps all secrets via toJSON(secrets)), AI agent session hooks, and a system daemon named kitty-monitor. This multi-layered approach ensures the attacker maintains long-term access even after the initial compromise is detected.\n\nThe incident was identified by Amazon Inspector and Google Open Source Security, with attribution to the TeamPCP threat actor. Organizations using @antv/g6-cli or any of the 314 affected packages should immediately revoke all exposed credentials and remove malicious versions."