Full Report
Researchers from multiple security firms observed a variant of Mini Shai-Hulud, self-replicating malware linked to TeamPCP, in all the affected packages. The post Massive supply-chain attack compromises 440 packages under four hours appeared first on CyberScoop.
Analysis Summary
# Incident Report: Massive npm Supply-Chain Attack (Mini Shai-Hulud Variant)
## Executive Summary
In early August 2026, a massive supply-chain attack compromised over 860 npm packages within a four-hour window using a self-replicating worm. The attack, linked to a variant of the "Mini Shai-Hulud" malware, initially targeted high-traffic packages like `keyv` to achieve a reach of over 2 billion monthly installs. The primary outcome was the automated theft of cloud credentials, GitHub tokens, and cryptocurrency wallets across approximately 46% of all cloud environments.
## Incident Details
- **Discovery Date:** August 4, 2026
- **Incident Date:** August 4, 2026
- **Affected Organization:** Multiple (npm ecosystem, GitHub maintainers)
- **Sector:** Technology / Software Development
- **Geography:** Global (Root operator previously traced to South Africa)
## Timeline of Events
### Initial Access
- **Date/Time:** Early Tuesday morning (within a 4-hour window)
- **Vector:** Account Takeover (ATO)
- **Details:** An attacker compromised a specific GitHub maintainer account that held publishing rights to high-profile npm packages.
### Lateral Movement
- The malware utilized a self-replicating "worm" mechanism. Once the first package (`keyv`) was poisoned, the attacker spent 30 minutes compromising additional packages under the same maintainer (`cacheable`, `flat-cache`, `file-entry-cache`).
- The attack then spread to other maintainers, eventually infecting over 860 packages.
### Data Exfiltration/Impact
- The automated payload harvested sensitive environment variables and configuration files.
- Impacted data includes AWS credentials, GitHub tokens, npm tokens, CI/CD credentials, AI-related configuration files, and cryptocurrency wallets.
### Detection & Response
- **Detection:** Monitored and identified by security firms including Aikido Security, Wiz, Socket, and Microsoft.
- **Response:** Security researchers published Indicators of Compromise (IoCs) and notified the npm registry to facilitate the removal of malicious package versions.
## Attack Methodology
- **Initial Access:** Stolen credentials/tokens of a prominent software maintainer.
- **Persistence:** Injection of malicious code into legitimate, high-traffic software libraries.
- **Defense Evasion:** Use of "Mini Shai-Hulud," a relatively small and less aggressive code base compared to previous versions, designed to blend into legitimate scripts.
- **Credential Access:** Automated harvesting of npm, GitHub, AWS, and CI tokens.
- **Discovery:** Scanning for AI configuration files and local wallet files.
- **Lateral Movement:** Self-replicating worm functionality that spreads through the dependency tree and shared maintainer permissions.
- **Exfiltration:** Automated "scooping" of collected secrets to attacker-controlled infrastructure.
- **Impact:** Wide-scale supply chain compromise affecting 46% of cloud environments.
## Impact Assessment
- **Financial:** High potential for loss via stolen cryptocurrency and unauthorized AWS/cloud resource usage.
- **Data Breach:** Massive theft of developer secrets and infrastructure access keys.
- **Operational:** Disruption to CI/CD pipelines and the need for global rotation of secrets.
- **Reputational:** Significant erosion of trust in the open-source npm ecosystem.
## Indicators of Compromise
- **File indicators:** Variants of the Mini Shai-Hulud malware (based on the TeamPCP open-source repository).
- **Behavioral indicators:**
- Unauthorized publishing of new versions for `keyv`, `cacheable`, `flat-cache`, and `file-entry-cache`.
- Unexpected outbound traffic from CI/CD environments to unknown endpoints.
- Automated scripts searching for `.aws/credentials`, `.git-credentials`, or wallet files.
## Response Actions
- **Containment:** Rapid identification of 440+ (and eventually 860+) poisoned packages to prevent further downloads.
- **Eradication:** Removal of malicious versions from the npm registry.
- **Recovery:** Development of hardening mechanisms like "package aging" (delaying updates for new/unvetted versions).
## Lessons Learned
- **The "Blast Radius" Problem:** Compromising a single maintainer of a "root" package (like `keyv`) can grant access to millions of downstream environments.
- **Speed of Attack:** The entire initial wave was completed in under four hours, outpacing human-led intervention.
- **Dependency Risks:** High-traffic packages are increasingly being targeted as "force multipliers" for malware distribution.
## Recommendations
- **Enforce MFA:** Mandatory Multi-Factor Authentication for all npm and GitHub maintainers.
- **Credential Rotation:** Implement short-lived tokens and frequent rotation for CI/CD and AWS environments.
- **Dependency Pinning:** Use lockfiles and avoid "floating" dependencies that automatically pull the latest (potentially poisoned) version.
- **Package Aging:** Implement security tooling that flags or blocks packages that were published within the last 24–48 hours until they are vetted.