Microsoft Threat Intelligence disclosed details of a widespread attack on the npm supply chain that affected more than 400 packages associated with seemingly unrelated publishers, including packages in enterprise software ecosystems such as keyv, flat-cache, and cache-manager. The malicious releases included a version of the Mini Shai-Hulud worm, a highly obfuscated JavaScript payload built with Bun and designed to steal credentials and spread automatically by republishing malicious updates.
The attack is particularly significant because of how it operates: the malware does not merely steal tokens from a developer’s device or a build environment; it also exploits those tokens to access npm, GitHub, Amazon Web Services, Kubernetes, and HashiCorp Vault, then scans the resources and secrets permitted by the stolen identities. According to Microsoft’s analysis published on August 4, 2026, any workstation or build agent that imported an affected package with npm lifecycle scripts enabled should be treated as potentially compromised.
Early Execution Inside Development Environments
The affected releases typically added a preinstall script that runs a file named setup.mjs before package installation is complete. The file launches a large, obfuscated Bun bundle, allowing the payload to execute on developer devices and build nodes before application tests begin or some traditional security checks reach this stage.
The worm first examines the environment to determine whether it is running on a developer workstation or within a CI/CD job. On developer devices, it detaches itself so it can continue running in the background after installation ends, while in CI/CD environments it remains attached to the job to take advantage of workflow secrets, worker credentials, and deployment permissions through OpenID Connect. It also checks that another copy is not running and stops on systems configured with the Russian language, according to Microsoft’s observations.
Stealing Credentials and Turning Them into Propagation
The payload begins by collecting locally available credential files, environment variables, command history, SSH keys, and cloud tools, in addition to data from the memory of GitHub Actions workers. Among other things, it attempts to obtain a GitHub CLI token. It then uses the extracted credentials to call the APIs of npm, GitHub, AWS, Kubernetes, and HashiCorp Vault, verify permissions, and collect additional secrets.
The results are compressed in JSON format and encrypted using AES-256-GCM, with the AES key encrypted through RSA-OAEP-SHA256, and then sent to an attacker-controlled HTTPS endpoint. GitHub is used as an alternate channel for exfiltrating data when the primary channel is unavailable. Microsoft noted that the active infrastructure at the time of analysis resolved to npm-cache[.]com, while earlier candidates included pypi-get[.]com and js-mirror[.]com.
The primary propagation mechanism examines npm tokens to determine whether they permit package writes or bypassing two-factor authentication, then downloads the latest tarball for each package available to the compromised identity. The worm copies itself into the archive, adds the setup loader and lifecycle script, increments the patch version, and republishes the package. This explains the appearance of malicious releases that look like ordinary patch updates without a corresponding commit, pull request, or matching release tag in the source repository.
Additional Paths Through GitHub
The payload checks GitHub token scopes, enumerates writable repositories, and searches for repositories in which workflows could expose additional secrets. It also includes a path targeting npm packages published through GitHub Actions as trusted publishers, which may give the published releases valid provenance because the publication comes from a legitimate workflow identity.
The worm can also inject configuration files into repository branches, including Claude- and Visual Studio Code-related paths such as .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs. These modifications provide a secondary infection path that can relaunch the payload while Claude or Visual Studio Code is being used, even after installation of the original package has ended. Microsoft stated that one of the backup GitHub paths also attempts to install a token-monitoring component, with a conditional destructive handler triggered when the monitored token is revoked.
What Does Microsoft Recommend?
Microsoft recommends updating the npm CLI to version 12 and using the min-release-age feature, as well as reviewing dependency trees, lockfiles, artifact repositories, and CI caches for the five affected releases, including indirect references. Known-safe versions should also be pinned, and npm and yarn caches should be cleared on developer devices and build hosts, especially when the compromised archives have entered a shared CI cache.
If a build system or workstation imported an affected release, credentials and secrets must be rotated from a clean device, because second-stage execution may expose tokens and affect build integrity. Recommendations also include enabling cloud protection for Microsoft Defender Antivirus, Microsoft Defender for Endpoint measurements, Microsoft Defender for Containers, and the investigation workflow in Microsoft Defender XDR across development and CI assets.
Response should not be limited to scanning devices. Organizations that produce software artifacts should review the hardening of the release process, token scopes, workflow approvals, protected environments, release provenance, and mechanisms for detecting unusual automated publishing, because the incident is consistent with abuse of CI/CD pipelines through GitHub Actions OIDC permissions. After remediation, projects should be rebuilt from a trusted baseline, and organizations should verify that compromised indicators are absent from caches and artifact repositories, review telemetry for remnants of Node.js such as Math_Symbol.js and Math_init.js or files with names resembling math_<guid>.js, and rebuild base images and modular build workers.