Is My Site Secure

npm · disclosed 29 April 2026

Mini Shai-Hulud npm worm (SAP, TanStack and AntV waves)

'Mini Shai-Hulud' is a 2026 credential-stealing worm campaign that hijacks npm publishing, via stolen maintainer accounts or abused CI/OIDC trusted publishing, to push trojanized package versions. Each malicious version adds an install-time hook (preinstall, or a 'prepare' script in a git-based optional dependency) that runs an obfuscated payload with the Bun runtime. The payload steals GitHub, npm, cloud, Kubernetes, Vault and SSH secrets and exfiltrates them encrypted, or to Dune-named repos created on the victim's own GitHub account. It also plants persistence in .claude/settings.json and .vscode/tasks.json and republishes the victim's other packages. Waves hit SAP's CAP/MBT packages (April 29), intercom-client (April 30), 42 TanStack Router packages (May 11) and, on May 19, 2026, more than 300 packages from the 'atool' account, including the AntV charting libraries, echarts-for-react, timeago.js and size-sensor.

  • Detectable by a website scanNo, server-side only
  • Last reviewed23 October 2026

Timeline

  1. First wave: mbt@1.2.48 is published at 09:55 UTC, followed by @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2 and @cap-js/db-service@2.10.1. The malware labels its dead-drop repos 'A Mini Shai-Hulud has Appeared' (Snyk).
  2. intercom-client@7.0.4 is published with stolen developer credentials and stays live on npm from about 15:00 to 17:00 UTC (GHSA-54pg-9963-v8vg).
  3. 84 malicious versions across 42 @tanstack/* packages are published between 19:20 and 19:26 UTC after the attacker pulled a GitHub Actions OIDC token from runner memory (TanStack postmortem). Snyk notes the releases carried valid SLSA provenance.
  4. TanStack issues an all-clear: every currently available version is safe to install.
  5. The npm account 'atool' is compromised. In roughly 01:39-02:56 UTC (sources differ), 639 malicious versions across 323 packages are published, mostly @antv/*, plus echarts-for-react, timeago.js, size-sensor and others (Socket).

Affected packages

PackageAffected versions
@antv/g25.5.8, 5.6.8
@antv/g65.2.1, 5.3.1
@antv/x63.2.7, 3.3.7
@antv/scale0.6.2, 0.7.2
echarts-for-react3.0.7, 3.1.7, 3.2.7
timeago.js4.1.2, 4.2.2
size-sensor1.0.4, 1.1.4, 1.2.4
jest-canvas-mock2.5.3, 2.6.3, 2.7.3
@tanstack/react-router1.169.5, 1.169.8
@tanstack/history1.161.9, 1.161.12
intercom-client7.0.4
mbt1.2.48
@cap-js/sqlite2.2.2
@cap-js/postgres2.2.2
@cap-js/db-service2.10.1

AntV/atool wave (2026-05-19): Socket counts 639 malicious versions across 323 unique packages. Snyk reports 637 versions across 323 packages, Chainguard reports 637 versions across 314 of atool's 547 packages, and SafeDep (cited by Corgea) reports 637 versions across 317 packages. The full campaign: Socket tracks 1,055 versions across 502 unique packages (1,048 npm versions across 498 npm packages, plus 6 PyPI entries across 3 packages and 1 Composer entry). TanStack wave: 84 versions across 42 packages (TanStack postmortem; full list in GHSA-g7cv-rxg3-hmpx). SAP wave: 4 packages (Snyk). AntV and TanStack versions above are from OSV/OpenSSF MAL records and GHSA-g7cv-rxg3-hmpx.

What to do

  1. Search lockfiles and caches, including transitive dependencies, for the affected versions, especially @antv/*, echarts-for-react, timeago.js, size-sensor and @tanstack/* router/start packages. Pin to versions published before the wave dates and reinstall with --ignore-scripts.
  2. If an affected version was installed anywhere in your build or deploy path, treat that machine or runner as compromised. Remove persistence first (.claude/settings.json SessionStart hook, .claude/setup.mjs, .vscode/tasks.json 'folderOpen' task, gh-token-monitor.sh and kitty-monitor services), then rotate all reachable secrets: npm, GitHub, cloud, hosting/deploy tokens, SSH and database credentials.
  3. Check your GitHub account and org for unexpected public repos with Dune-style names (e.g. 'word-word-123') or reversed-text descriptions such as 'niagA oG eW ereH :duluH-iahS', and for injected workflows such as .github/workflows/codeql.yml named 'Run Copilot' or format-check.yml.
  4. Block egress to t.m-kosche.com (AntV wave) and filev2.getsession.org / seed1-3.getsession.org (TanStack wave) from CI and developer machines, and review CI logs for unexpected npm publishes or Sigstore signing.
  5. Don't treat npm provenance or signatures as proof a release is clean. Use exact pinning, a cooldown before adopting new versions, and --ignore-scripts by default in CI.

Sources

We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.