Malicious code in @antv/xflow-core (npm)

A threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages as part of the "Mini Shai-Hulud" supply chain attack campaign. The attack was executed in an automated 22-minute burst, affecting a large portion of the npm ecosystem.

Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun script. This script uses the GitHub API as a covert exfiltration channel to steal sensitive credentials, including AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker authentication configs, database connection strings, Stripe keys, and Slack tokens. Stolen credentials are committed to attacker-controlled repositories following Dune-themed naming patterns (e.g., harkonnen-melange-742).

The malicious packages establish persistence through multiple mechanisms: CI/CD workflow injection (a GitHub Actions workflow named Run Copilot dumps all secrets via toJSON(secrets)), AI agent session hooks, and a system daemon named kitty-monitor. The specific package @antv/xflow-core was modified to include the malicious preinstall hook executing the obfuscated Bun payload.

The incident was identified by multiple security sources including Amazon Inspector and Google Open Source Security, confirming the compromise as part of the ongoing "Mini Shai-Hulud is back" worm attributed to the TeamPCP threat actor.