Notifications
Clear all
Topic starter
02/08/2026 11:35 am
TL;DR: Hundreds of npm packages were compromised in the latest Mini Shai-Hulud wave, which stole plaintext secrets from CI/CD runners and developer environments and used stolen tokens to spin up more than 2,700 rogue GitHub repositories, according to Aikido. The pattern shows why install-time execution and publishing rights are now a governance problem, not just a detection problem.
NHIMG editorial — based on content published by Aikido: Mini Shai-Hulud strikes again, npm worm compromises hundreds of @antv packages
By the numbers:
- Over 2,700 rogue GitHub repositories have already been spun up using stolen tokens.
Questions worth separating out
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do NHI secrets in build systems create such a large blast radius?
A: Build systems often hold reusable credentials for source control, cloud access, and package publishing, so one compromise can cross multiple trust boundaries.
Q: What do organisations get wrong about machine secrets in CI/CD pipelines?
A: The most common mistake is treating secrets as deployment convenience rather than identity risk.
Practitioner guidance
- Block unvetted package ages Refuse to install newly published npm versions until they pass an internal age threshold, especially in CI and developer bootstrap workflows.
- Tighten maintainer publishing rights Review every account that can publish to high-download packages, remove shared maintainer access, and require separate credentials for publishing versus ordinary repository access.
- Rotate secrets from touched environments If a compromised package executed on a workstation or runner, rotate GitHub tokens, npm tokens, cloud keys, SSH keys, Vault tokens, and Kubernetes service account material from that environment, not just the package registry token.
What's in the full article
Aikido's full post covers the operational detail this analysis intentionally leaves for the source:
- The full package-level IOC list for the affected @antv, echarts-for-react, and related npm versions.
- Detailed install-time payload markers, including the exact preinstall hook and optional dependency path used by the worm.
- The complete detection and mitigation checklist for CI logs, endpoint artefacts, and outbound telemetry indicators.
- The broader historical comparison with earlier SAP and TanStack waves, including campaign markers and republishing behaviour.
👉 Read Aikido's analysis of the Mini Shai-Hulud npm supply chain worm →
Mini shai-hulud npm worm: what it means for NHI governance?
Explore further
02/08/2026 12:49 pm
Standing publish privilege is now a supply chain risk, not just a release-management issue. The worm does not need to compromise npm itself when one maintainer token can rewrite a large portion of a package namespace. That turns publishing rights into a privileged identity that needs lifecycle controls, not informal trust. For practitioners, the question is no longer who can publish in theory, but which accounts can still reach too much in one session.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How should organisations respond when package publishing credentials are stolen?
A: Immediately revoke the stolen publishing access, review recent publishes, and rotate every adjacent credential that the compromised identity could reach. Then inspect developer endpoints for persistence, because the attacker may have left backdoors outside the package manager. Response has to cover both registry access and local workstation state.
👉 Read our full editorial: Mini shai-hulud npm worm shows how secret theft fuels package spread
