Microsoft Threat Intelligence disclosed details of a widespread attack on the npm supply chain that affected more than 400 packages associated with seemingly unrelated publishers, including packages in enterprise software ecosystems such as keyv, flat-cache, and cache-manager. The malicious releases contained a version of the Mini Shai-Hulud worm, a highly obfuscated JavaScript payload built on Bun and designed to steal credentials and spread automatically by republishing malicious updates.
The attack is particularly significant because of how it operates: the malware does not merely steal tokens from a developer’s device or build environment; it also uses those tokens to access npm, GitHub, Amazon Web Services, Kubernetes, and HashiCorp Vault, then enumerates the resources and secrets permitted by the stolen identities. According to Microsoft’s analysis published on August 4, 2026, any workstation or build agent that imported an affected package with npm lifecycle scripts enabled should be treated as compromised.
Early Execution Inside Development Environments
The affected releases typically added a preinstall script that ran a file named setup.mjs before package installation was complete. The file launches a large, obfuscated Bun bundle, allowing the payload to execute on developer devices and build nodes before application testing begins or some traditional security checks reach this stage.
The worm first inspects the environment to determine whether it is running on a developer workstation or within a CI/CD job. On developer devices, it detaches itself so it can continue running in the background after installation ends, while in CI/CD environments it remains attached to the job to take advantage of workflow secrets, agent credentials, and deployment permissions through OpenID Connect. It also checks that another instance is not running and stops on systems using the Russian language, according to Microsoft’s observations.
Stealing Credentials and Turning Them Into Propagation
The payload begins by collecting locally available credential files, environment variables, command history, SSH keys, and cloud tools, in addition to data from GitHub Actions runner memory. Among other things, it attempts to obtain a GitHub CLI token. It then uses the extracted credentials to call the APIs of npm, GitHub, AWS, Kubernetes, and HashiCorp Vault, verify permissions, and collect additional secrets.
The results are compressed as JSON and encrypted using AES-256-GCM, with the AES key encrypted through RSA-OAEP-SHA256, then sent to an HTTPS endpoint controlled by the attacker. GitHub is used as an alternative channel for data exfiltration when the primary channel is unavailable. Microsoft noted that the active infrastructure at the time of analysis resolved to npm-cache[.]com, while previous candidates included pypi-get[.]com and js-mirror[.]com.
The primary propagation mechanism scans npm tokens to determine whether they permit package publishing or bypassing two-factor authentication, then downloads the latest tarball for every package available to the compromised identity. The worm copies itself into the archive, adds the setup loader and lifecycle script, increments the patch version, and republishes the package. This explains the appearance of malicious releases that look like ordinary patch updates without a corresponding commit, pull request, or matching release tag in the source repository.
Additional Paths Through GitHub
The payload checks GitHub token scopes, enumerates writable repositories, and searches for repositories whose workflows might expose additional secrets. It also includes a path targeting npm packages published through GitHub Actions as trusted publishers, which may give published releases valid provenance because the publication comes from a legitimate workflow identity.
The worm can also inject configuration files into repository branches, including Claude- and Visual Studio Code-related paths such as .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs. These modifications provide a secondary infection path that can relaunch the payload while Claude or Visual Studio Code is being used, even after installation of the original package has ended. Microsoft said that one of the GitHub fallback paths also attempts to install a token-monitoring component, with a conditional destructive handler triggered when the monitored token is revoked.
What Does Microsoft Recommend?
Microsoft recommends updating the npm CLI to version 12 and using the min-release-age feature, as well as reviewing dependency trees, lockfiles, artifact repositories, and CI caches for the five affected releases, including indirect references. Known-safe versions should also be pinned, and npm and yarn caches should be cleared on developer devices and build hosts, particularly when compromised archives may have entered a shared CI cache.
If a build system or workstation imported an affected release, credentials and secrets should be rotated from a clean device, because execution of the second stage may expose tokens and affect build integrity. Recommendations also include enabling cloud protection for Microsoft Defender Antivirus, Microsoft Defender for Endpoint measurements, Microsoft Defender for Containers, and the investigation workflow in Microsoft Defender XDR across development and CI assets.
Response should not be limited to scanning devices. Organizations that produce software artifacts should review the hardening of their release process, token scopes, workflow approvals, protected environments, release provenance, and mechanisms for detecting unusual automated publishing, because the incident is consistent with abuse of CI/CD pipelines through GitHub Actions OIDC permissions. After remediation, projects should be rebuilt from a trusted baseline, organizations should verify that compromised indicators are absent from caches and artifact repositories, and measurements should be reviewed for Node.js remnants such as Math_Symbol.js and Math_init.js or files with names resembling math_<guid>.js, while base images and modular build agents should be rebuilt.