Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
2026-05-21T14:52:15Z•7b551c3e3e2e5aa66211cd2da19941d9173e970b51bc88447d31f42205be1d4a
1passwordantvawsci/cdcredential-theftgithubhashicorp-vaultkuberneteslinuxmalicious-packagemini-shai-huludnpmnpm-installopen-source-compromisesecrets-exfiltrationsupply-chain
What happened
Compromised @antv npm packages deliver a malware payload called “Mini Shai‑Hulud” that runs during npm install on Linux-based automation environments to harvest CI/CD secrets. The malware targets credentials and tokens across GitHub, AWS, Kubernetes, HashiCorp Vault, npm, and 1Password, enabling exfiltration and potential cloud-wide compromise via stolen CI/CD credentials.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 7b551c3e3e2e5aa66211cd2da19941d9173e970b51bc88447d31f42205be1d4a
- Enrichment time
- 2026-05-21T14:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.