AI-Assisted Supply Chain Attacks | Stay protected with Chainguard

Jun 01, 2026

An attacker compromised a Red Hat employee's GitHub account and used the associated GitHub Actions OIDC trusted publisher to ship malicious versions across 90+ projects. The confirmed delivery vector, patch-client@4.0.4, executes via a preinstall hook, which deploys an obfuscated payload that harvests cloud credentials, CI secrets, and registry tokens. The worm self-propagates by republishing tampered npm tarballs and injecting malicious GitHub Actions workflows into accessible repositories. This is the latest attack in the Mini Shai-Hulud toolkit.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

@redhat-cloud-services/* (32 projects; 90+ versions)

Impact:

The compromised packages span Red Hat's cloud services frontend ecosystem that has 100K+ weekly downloads. The payload targets the full credential chain across AWS, Azure managed identity, GCP service accounts, HashiCorp Vault, Kubernetes service account tokens, GitHub PATs, npm tokens, Bitwarden, and gopass vaults, and approximately 40 CI provider credential patterns including NPM_TOKEN, GITHUB_TOKEN, CIRCLE_TOKEN, and ANTHROPIC_API_KEY. The attacker used a Red Hat employee’s GitHub account to abuse GitHub Actions OIDC trusted publishing to mint valid publish tokens without a static NPM_TOKEN, and the same publishing path covers all 95 projects in the namespace. This means that a single compromised workflow run could yield tokens for every package. The worm exfiltrates stolen credentials to attacker-created public GitHub repos (description: "Miasma: The Spreading Blight"), republishes poisoned npm tarballs signed via Sigstore/Fulcio, and injects a YAML file on a new branch, disguising malware as a legitimate security improvement to trick maintainers into merging. To date, 290+ repositories are affected. The payload checks for CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before executing, and installs persistence via .claude/settings.json and .vscode/tasks.json.

Remediation:

If you installed patch-client@4.0.4, treat all credentials reachable from that host or CI runner as compromised. Rotate AWS keys, npm tokens, GitHub PATs, and Vault tokens immediately.
Check for persistence artifacts before rotating credentials: .claude/settings.json, .vscode/tasks.json, and /tmp/kitty-* daemon paths on affected systems.
Pin to patch-client@4.0.3 or earlier. Verify tarballs against known-good SHA256 hashes — lockfile presence alone is insufficient as the worm tampers with tarballs in transit.
Audit all @redhat-cloud-services/* packages for unexpected publish timestamps around June 1, 2026.
Review .github/workflows/ for unexpected commits, especially PRs adding codeql.yml on branch chore/add-codeql-static-analysis, and check for unexpected public repositories under your accounts.
Block the Bun runtime download URL and monitor for /tmp/p*.js, /tmp/b-*/bun, and /tmp/kitty-* runtime artifacts.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Actions

Why Chainguard is safe

Mini Shai-Hulud "Miasma" delivers its payload via npm preinstall lifecycle hooks. Chainguard doesn't build libraries that use install-time scripts, as they have shown to often carry malicious payloads, meaning none of the 90+ compromised versions exist in the Chainguard Libraries for JavaScript catalog. The malicious versions were also never served via the upstream fallback, which is protected by a cooldown period. Chainguard customers using Chainguard Actions would not be affected by this injected codeql.yml workflow. Chainguard Actions hardens and re-publishes upstream actions, with each hardened action pinning its internal uses: and container image references to immutable SHAs.

May 27, 2026

183 npm Packages Target Cloud and Finance via oob.moika.tech

A single threat actor operating four npm accounts (mr.4nd3r50n, pik-libs, t-in-one, emcd-vue) published 183 malicious packages across nine scoped namespaces in four waves between May 27 and June 1, 2026. The campaign used dependency confusion — publishing high-version (99.99.99) packages to the public npm registry under names that shadow internal corporate namespaces — targeting a Russian cloud platform provider, a financial institution, Sberbank's payment ecosystem, and the EMCD crypto exchange. Every package executes a postinstall hook that exfiltrates the victim's full process.env to an attacker-controlled C2 at oob.moika.tech, then downloads and spawns a detached second-stage process. The campaign evolved across four waves with increasing sophistication, from cleartext payloads in Wave 1 to WaCk/JScrambler obfuscation, home-directory persistence, and a structured FUSION_ second-stage protocol in Wave 4. A RECON_ONLY server-side flag indicates the attacker is in reconnaissance mode with full exploitation capability held in reserve.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

@cloudplatform-single-spa/* (122 packages; version 99.99.99)@mlspace/* (17 packages; version 99.99.99)@car-loans/* (19 packages; version 99.99.99)@fb-deposit/* (4 packages; version 99.99.99)@debit-ib/* (2 packages; version 99.99.99)@t-in-one/* (10 packages; version 5.7.1)@capibar.chat/ui-kit (versions 99.0.7, 99.5.7)@sber-ecom-core/sberpay-widget (versions 99.0.7, 99.5.8)@sber-ecom-core/sberpay-widget (versions 99.0.7, 99.5.8)

Impact:

The 183 packages span nine scoped namespaces mirroring specific internal service names — including billing, VPN, Kubernetes, ML inference, IAM, loan flows, deposit forms, debit card applications, and crypto exchange modules, indicating the actor profiled each target organization's internal package ecosystem before publishing. The specificity of package names such as @cloudplatform-single-spa/certificate-manager, @cloudplatform-single-spa/vpn, @cloudplatform-single-spa/ml-inference, and @sber-ecom-core/sberpay-widget confirms targeted reconnaissance rather than opportunistic squatting. On install, the postinstall hook transmits the victim's full process.env to oob.moika.tech — capturing any API keys, CI secrets, cloud credentials, npm tokens, GitHub PATs, or other secrets present in the developer or CI environment at install time. A second-stage binary is simultaneously fetched from https://oob.moika.tech/payload/{mac|win|linux}.js and spawned as a detached child process using .unref(), surviving after npm install exits. Wave 4 (June 1) introduced home-directory persistence, writing the payload to ~/.emcd-vue_init.js rather than os.tmpdir(), which survives reboots and OS temp cleanup. The RECON_ONLY=1 flag, currently set server-side, indicates that the actor is collecting environment fingerprints and holding exploitation for a follow-on phase. Server-side toggling means full exploitation can be enabled against already-compromised environments without requiring a new install. The campaign pre-staged benign versions of @capibar.chat/ui-kit and @sber-ecom-core/sberpay-widget on May 4, 2026 — 23 days before the malicious wave — to establish namespace presence and bypass registry age-based filters. All packages carried a shared hardcoded X-Secret header value (l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1) across all four accounts and all four waves, tying the entire campaign to a single operator.

Remediation:

If any of the affected package versions were installed on or after May 4, 2026 (pre-staged versions) or May 27, 2026 (malicious versions), treat all credentials present in that environment as compromised. Check package-lock.json, yarn.lock, and CI build logs to determine exposure.
Rotate credentials immediately in this order: npm tokens, GitHub PATs, AWS keys (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), GCP service account keys, Azure credentials, HashiCorp Vault tokens, and any other secrets present in process.env on affected machines.
Check for and remove persistence artifacts before assuming a clean state:
- /tmp/._cloudplatform-single-spa_init.js
- /tmp/._t-in-one_init.js
- ~/.emcd-vue_init.js
- ~/.cache/._t-in-one_init/
- ~/.emcd-vue_init/
Scope-lock all nine targeted npm scopes to your private registry in .npmrc to prevent public registry fallback resolution.
Block egress to oob.moika.tech, npm.t-in-one.io, docs.t-in-one.io, and jira.t-in-one.io at your network perimeter.
Use npm ci instead of npm install in all CI pipelines. npm ci installs exactly from the lock file and fails on discrepancy, preventing dependency confusion substitution.
Add --ignore-scripts to npm install in CI environments where lifecycle scripts are not required, preventing postinstall hooks from running at all.
Verify clean state by confirming no stager files remain, no outbound connections to oob.moika.tech appear in ~/.npm/_logs/, and no affected scopes appear in installed packages.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Why Chainguard is safe

The oob.moika.tech campaign delivers its payload exclusively via npm postinstall lifecycle hooks combined with dependency confusion — publishing malicious tarballs to the public npm registry under names that shadow internal corporate namespaces. Chainguard doesn't build libraries that use install-time scripts, as they have consistently shown to carry malicious payloads, meaning none of the 183 malicious packages were ever built into the Chainguard npm Libraries catalog. Even if a future wave targets a namespace Chainguard carries, the malicious versions would never be served via the upstream fallback, which is protected by a cooldown period that prevents newly published registry versions from being consumed immediately.

May 22, 2026

Laravel Lang

An attacker compromised the maintainer of the Laravel-Lang GitHub organization and, in a 15-minute automated burst, rewrote every git tag across four popular Composer packages. The rewritten tags inject a malicious autoload file that fires the moment any Laravel application boots, dropping a hidden PHP loader that harvests cloud credentials, CI secrets, browser passwords, SSH keys, and cryptocurrency wallets to a typosquatted domain before deleting itself from disk.

Maintainer Compromise

Attack overview

Compromised artifacts

Packagist Packages:

laravel-lang/lang (502 versions)laravel-lang/attributes (86 versions)laravel-lang/http-statuses (66 versions)laravel-lang/actions (46 versions)

Impact:

The attacker rewrote every existing git tag rather than publishing new versions, so any project running composer update or doing a fresh install resolved to poisoned code. Unlike typical registry compromises, no malicious code was committed to the official repositories. Instead, the attacker rewrote tags to point at commits in an attacker-controlled fork, leaving official commit histories clean. Attackers injected malware across 650+ versions across four packages were rewritten in approximately 15 minutes, indicating org-level credential compromise. The payload abuses Composer's autoload.files mechanism to register a dropper—a first-stage loader that fetches and executes the credential stealer—at every application startup. The second-stage payload is a full credential-harvesting framework with 17 distinct collectors targeting AWS/GCP/Azure cloud metadata, Kubernetes service account tokens, HashiCorp Vault secrets, CI/CD pipeline tokens (Jenkins, GitLab, GitHub Actions, CircleCI), browser login data (with a dedicated binary to bypass Chrome v127+ App-Bound Encryption), password managers (1Password, Bitwarden, LastPass, KeePass), cryptocurrency wallets, VPN configurations, SSH keys, and environment variables. Stolen data is XOR-encrypted and exfiltrated to an attacker-controlled domain before the dropper self-deletes from disk after execution, while continuing to run from memory, making forensic detection on live systems difficult. The full downstream impact is still to be understood.

Remediation:

Pin Composer dependencies by committing composer.lock to version control and running composer install instead of composer update in CI. A committed lockfile with a pre-attack SHA would have prevented this entirely.

Inspect composer.lock for these packages. If the lockfile was regenerated on or after 2026-05-22 23:41 UTC, treat the environment as compromised.

Rotate all secrets accessible to the compromised environment: CI tokens, cloud credentials, GitHub PATs, and deploy keys.

Block egress to flipboxstudio[.]info on all CI runners and developer machines.

Audit outbound DNS and HTTPS logs retroactively for requests to flipboxstudio[.]info to determine whether exfiltration occurred before the block was in place.

Check running processes for orphaned php and unnamed ELF processes with ppid=1 executing from deleted paths under /tmp.

Check /tmp/.laravel_locale/ for the dropper's execution marker — its presence confirms the dropper ran on that host.

Inspect git commit author metadata in vendor/laravel-lang/ for Your Name you@example.com — a direct indicator of malicious commits.

Chainguard protection

UNAFFECTED Chainguard Artifacts

Containers

Why Chainguard is safe

Chainguard's Laravel container image is built from verified upstream source and does not pull dependencies from Composer at runtime. The compromised laravel-lang packages were distributed through rewritten git tags on GitHub, which only affect environments that resolve Composer dependencies dynamically. Chainguard container images pin all dependencies at build time against verified source, so the poisoned tags were never incorporated.

May 19, 2026

@antv / Mini Shai-Hulud Wave 5

A compromised npm maintainer account published 639 malicious package versions across 323 packages in Alibaba’s AntV data visualization ecosystem in a 22-minute automated burst — the latest wave of Mini Shai-Hulud, the self-propagating npm supply chain worm that has hit CrowdStrike packages, the Nx build system, and TanStack over the past eight months. The payload fires via preinstall lifecycle hooks, sweeps 130+ credential file patterns, scrapes GitHub Actions runner memory to bypass secret masking, and exfiltrates via an OpenTelemetry-disguised HTTPS endpoint and a GitHub dead-drop under the victim's own account. Persistent backdoors are installed into Claude Code and VS Code configurations, and a long-lived C2 daemon enables arbitrary code execution on compromised machines indefinitely.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

echarts-for-react@3.0.7, 3.1.7, 3.2.7timeago.js@4.1.2, 4.2.2size-sensor@1.0.4, 1.1.4, 1.2.4@antv/scale@0.6.2, 0.7.2@antv/g6@5.2.1, 5.3.1

Impact:

The compromised packages collectively represent approximately 16 million weekly downloads spanning enterprise data visualization, charting, graph visualization, geospatial mapping, and spreadsheet rendering. The payload harvests the full AWS credential chain, Google Cloud, Azure, GitHub tokens, npm publish tokens, SSH keys, Kubernetes service account tokens, HashiCorp Vault tokens, Stripe keys, database connection strings, cryptocurrency wallets, and Claude AI API credentials. In GitHub Actions environments, the payload reads Runner.Worker process memory directly via /proc/[pid]/mem, recovering every masked secret in plaintext. A self-replicating worm component uses stolen npm tokens to automatically poison additional packages, extending the blast radius beyond the initial atool account compromise. Over 2,500 attacker-created GitHub repositories are publicly visible, each representing a confirmed credential theft from a unique environment.

Remediation:

Clear caches and reinstall using pinned package versions published before 2026-05-19 01:39 UTC.
Remove persistence before rotating credentials: stop and disable kitty-monitor systemd service (Linux) or LaunchAgent (macOS), delete ~/.local/share/kitty/cat.py, ~/.local/bin/gh-token-monitor.sh, .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, .vscode/setup.mjs, and .github/workflows/codeql.yml.
Rotate all credentials in this order: npm tokens, GitHub PATs and Actions secrets, AWS keys, GCP service accounts, Azure service principals, Kubernetes service account tokens, Vault tokens, SSH keys, database connection strings, and all remaining API keys.
Audit GitHub account for unexpected public repositories with Dune-universe names or the description niagA oG eW ereH :duluH-iahS.
Block t.m-kosche.com at the network perimeter for all CI runners and developer machines.

Chainguard protection

UNAFFECTED Chainguard Artifacts

JavaScript Libraries

Actions

Why Chainguard is safe

Mini Shai-Hulud delivers its payload exclusively via npm lifecycle hooks: preinstall, postinstall, and prepare. Mini Shai-Hulud delivers its payload exclusively via npm lifecycle hooks: preinstall, postinstall, and prepare. Chainguard builds JavaScript libraries from source and does not include packages that require install-time scripts. The malicious AntV versions were never built into the Chainguard Libraries catalog, and the hooks that trigger the payload were never present. Customers using Chainguard Repository's upstream npm fallback are also protected — the default cooldown policy blocked the malicious versions from being served during the 39-minute attack window.

May 14, 2026

node-ipc

An attacker published three malicious versions of node-ipc directly to npm, injecting a credential harvester into the CommonJS entry point while leaving the ESM entry point clean. The payload fires on every require('node-ipc'), sweeps over 90 credential file patterns, and exfiltrates via DNS TXT queries to Google DNS and HTTPS POST to a typosquatted Azure domain.

Backdoored package

May 11, 2026

Mini Shai Hulud: npm & PyPI Worm

The TeamPCP campaign that began with the SAP compromise on April 29 returned at scale. Attackers exploited pull_request_target workflow vulnerabilities to hijack @TanStack's CI/CD pipeline and push malicious lifecycle scripts into 42 @TanStack packages across 84 versions. The poisoned @TanStack packages carried valid SLSA provenance — signed by TanStack's own CI pipeline — making them indistinguishable from legitimate releases. From there, the blast radius expanded to include 400+ npm and PyPI package versions across 100+ namespaces — including @mistralai, @uipath, and @squawk. Collectively, these dependencies have 500M+ monthly downloads. The malware silently harvests CI/CD secrets, cloud credentials, and GitHub tokens and includes a deadman's switch that deletes a developer's entire repository if the credential harvester's permissions are revoked. Note: This attack is different than the typosquat/brandsquat attack against TanStack from April 29, 2026.

Install-Time Script

Attack overview

Compromised artifacts

npm Packages:

@tanstack/* (42 packages, 84 versions)@uipath/* (66 packages, 66 versions)@squawk/* (22 packages, 110 versions)@mistralai/* (3 packages, 9 versions)@tallyui/* (10 packages, 30 versions)@beproduct/nestjs-auth (18 versions)and 50 more versions across 15+ dependencies

PyPI Packages:

mistralai@2.4.6guardrails-ai@0.10.1

Impact:

Malicious lifecycle hooks exfiltrated GitHub tokens, npm publish credentials, AWS/Azure/GCP keys, Kubernetes configs, and environment variables from developer machines and CI/CD runners. The malware persists long after the infected package is removed: by writing itself into .claude/settings.json and .vscode/tasks.json, it re-executes every time a developer uses Claude Code or opens VS Code in the affected project directory. npm uninstall does not fix this. The novel deadman's switch makes standard incident response ineffective: rotating compromised credentials — the first thing any security team does — triggers automatic deletion of the developer's entire home directory, turning remediation into a destructive event. This is the first documented npm worm to ship with valid, attacker-generated SLSA provenance. The malicious packages were signed by TanStack's own CI pipeline, meaning cryptographic provenance (a signal defenders rely on to distinguish legitimate packages from tampered ones) provided no protection here. The deliberate targeting of @mistralai, @uipath, and AI tooling broadly signals this campaign's focus on AI development pipelines.

Remediation:

Check developer machines and project roots for gh-token-monitor daemon and remove it before rotating any GitHub tokens as the deadman's switch triggers on revocation.
Audit .claude/ and .vscode/ directories for router_runtime.js, setup.mjs, and unfamiliar entries in settings.json or tasks.json. These persist after npm uninstall.
Once persistence is cleared, rotate all credentials: GitHub tokens, npm tokens, AWS/Azure/GCP keys, Kubernetes service account tokens, and Vault tokens.