Malicious code in @antv/semantic-release-pnpm (npm)

A threat actor compromised the npm account atool and executed a coordinated supply chain attack campaign called "Mini Shai-Hulud." In a 22-minute automated burst, the attacker published 631 malicious versions across 314 npm packages, including @antv/semantic-release-pnpm.\n\nEach malicious version contains a preinstall hook that executes a 498KB obfuscated Bun script. The script exfiltrates sensitive credentials via the GitHub API as a covert channel, including AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker auth configs, database connection strings, Stripe keys, and Slack tokens. Stolen credentials are committed to attacker-controlled repositories following Dune-themed naming patterns (e.g., harkonnen-melange-742).\n\nBeyond credential theft, the malicious packages establish persistence through multiple mechanisms: CI/CD workflow injection (a GitHub Actions workflow named Run Copilot that dumps all secrets via toJSON(secrets)), AI agent session hooks, and a system daemon named kitty-monitor. This multi-layered persistence approach suggests the attacker intended long-term access to compromised systems.\n\nThe attack was identified by Amazon Inspector and Google Open Source Security, confirming the presence of malicious code in the affected packages."