Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
2026-05-21T02:52:14Z•e11c0d41eb19dde29ebf10a9fbbc65d2d7f04535dec5d480103898ab05a20379
1password@antvCI/CDawscredential-theftdependency-compromisegithubkuberneteslinuxmalwaremini-shai-huludnodejsnpmnpm-installsupply-chainvault
What happened
Microsoft reports a supply‑chain compromise of multiple @antv npm packages that deploy a payload dubbed “Mini Shai‑Hulud” during npm install. The malware targets CI/CD environments on Linux, exfiltrating credentials and tokens for GitHub, AWS, Kubernetes, HashiCorp Vault, npm, 1Password, and other automation secrets. This is a malicious package compromise aimed at stealing CI/CD secrets from build/automation systems.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- e11c0d41eb19dde29ebf10a9fbbc65d2d7f04535dec5d480103898ab05a20379
- Enrichment time
- 2026-05-21T02:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.