Malicious code in @antv/gi-sdk (npm)

A threat actor compromised the npm account atool and executed a coordinated supply chain attack known as "Mini Shai-Hulud," publishing 631 malicious versions across 314 npm packages in an automated 22-minute burst. The @antv/gi-sdk package was among those compromised.\n\nEach malicious version injects a preinstall hook that executes a 498KB obfuscated Bun script. This script uses the GitHub API as a covert exfiltration channel to steal sensitive credentials, including AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker auth configs, database connection strings, Stripe keys, and Slack tokens. Stolen credentials are committed to attacker-controlled repositories following Dune-themed naming patterns (e.g., harkonnen-melange-742).\n\nThe attack establishes multiple persistence mechanisms: CI/CD workflow injection via a GitHub Actions workflow named Run Copilot that dumps all secrets using toJSON(secrets), AI agent session hooks, and a system daemon named kitty-monitor. This multi-layered approach ensures continued access and data exfiltration even after initial detection.\n\nThe incident was identified by both Amazon Inspector and Google Open Source Security, with attribution to the TeamPCP threat actor. The attack represents a significant supply chain compromise affecting potentially thousands of downstream users and organizations.