Malicious code in @antv/l7-three (npm)

A threat actor compromised the npm account atool and executed an automated supply chain attack dubbed "Mini Shai-Hulud," publishing 631 malicious versions across 314 npm packages in a 22-minute burst. The @antv/l7-three package was among those compromised.

Each malicious version includes a preinstall hook that executes a 498KB obfuscated Bun script. The script exfiltrates sensitive credentials—including AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker auth configs, database connection strings, Stripe keys, and Slack tokens—using the GitHub API as a covert exfiltration channel. Stolen credentials are committed to attacker-controlled repositories following Dune-themed naming patterns (e.g., harkonnen-melange-742).

Beyond credential theft, the malicious payload establishes persistence through multiple mechanisms: CI/CD workflow injection (a GitHub Actions workflow named Run Copilot that dumps all secrets via toJSON(secrets)), AI agent session hooks, and a system daemon named kitty-monitor. The attack was attributed to the TeamPCP threat actor and identified by Amazon Inspector and Google Open Source Security.

Affected users should immediately audit their systems for the presence of the kitty-monitor daemon, review CI/CD workflows for unauthorized Run Copilot actions, rotate all credentials that may have been exposed, and update to patched versions of affected packages.