Post

@threatintel.microsoft.com

Microsoft Threat Intelligence is tracking active Mini Shai-Hulud npm supply chain attacks in which a threat actor compromised trusted maintainer accounts to distribute credential-stealing malware.

4/8/26, 2:03 pm3 reposts6 likes

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

Compromised packages (confirmed malicious) include: - keyv@6.0.0 - file-entry-cache@11.1.6 - cache-manager@7.2.10 - cacheable-request@13.0.20 - @qlik/api@2.14.2 - @cacheable/memory, /utils, /net - 17+ @servicetitan/* packages (eslint-config, anvil-themes, table, form, log-service, etc.)

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

In this attack, a malicious preinstall hook launches an obfuscated dropper (setup.mjs) that downloads a Bun binary from GitHub and executes a credential-stealing payload, either Math_Symbol.js or Math_Init.js.

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

The payload is a Mini Shai-Hulud variant, a self-propagating npm supply-chain malware family. It harvests npm, GitHub, cloud and continuous integration (CI) credentials, and exfiltrates collected secrets.

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

It also uses stolen publishing access to inject itself into package tarballs, increment their versions, and republish the compromised releases. Microsoft observed the same pattern across all affected packages, suggesting a single actor using multiple stolen tokens.