Post

Microsoft Threat Intelligence is tracking active Mini Shai-Hulud npm supply chain attacks in which a threat actor compromised trusted maintainer accounts to distribute credential-stealing malware.

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

Compromised packages (confirmed malicious) include: - keyv@6.0.0 - file-entry-cache@11.1.6 - cache-manager@7.2.10 - cacheable-request@13.0.20 - @qlik/api@2.14.2 - @cacheable/memory, /utils, /net - 17+ @servicetitan/* packages (eslint-config, anvil-themes, table, form, log-service, etc.)

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

In this attack, a malicious preinstall hook launches an obfuscated dropper (setup.mjs) that downloads a Bun binary from GitHub and executes a credential-stealing payload, either Math_Symbol.js or Math_Init.js.

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

The payload is a Mini Shai-Hulud variant, a self-propagating npm supply-chain malware family. It harvests npm, GitHub, cloud and continuous integration (CI) credentials, and exfiltrates collected secrets.

Microsoft Threat Intelligence

@threatintel.microsoft.com

It also uses stolen publishing access to inject itself into package tarballs, increment their versions, and republish the compromised releases. Microsoft observed the same pattern across all affected packages, suggesting a single actor using multiple stolen tokens.

4/8/26, 2:07 pm0 reposts2 likes

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

Microsoft Defender for Endpoint customers should act on these alerts: “Trojan:npm/MalBun.A”

Microsoft Threat Intelligence

@threatintel.microsoft.com

4 Aug

Microsoft has published an in-depth technical analysis of the supply chain attack known as "ChainDrop" affecting hundreds of packages and delivering a self-propagating credential-stealing worm. Read our blog for mitigation, detection, hunting guidance: msft.it/63322aDUa0