Compromised @antv npm packages deploy credential-stealing malware

Affected Systems

Multiple @antv npm packages compromised with Mini Shai-Hulud malware. Affects Linux-based CI/CD pipelines using npm install. Targets credentials from GitHub, AWS, Kubernetes, HashiCorp Vault, npm, and 1Password. All organizations using @antv packages in automated build environments are at risk.

Exploitation Status

Active supply chain attack. Malware executes automatically during npm install in affected environments. Compromised packages were published to npm registry and actively stealing credentials from CI/CD systems.

Business Impact

Critical impact to CI/CD security posture. Stolen credentials provide attackers with access to source code repositories, cloud infrastructure, secrets management systems, and deployment pipelines. Potential for lateral movement across entire development and production infrastructure. Organizations using affected packages must assume credential compromise and rotate all secrets accessible from build environments.

Urgency

🔴 Immediate

Recommended Actions

• Immediately audit all CI/CD pipelines and development environments for @antv package usage and remove compromised versions
• Rotate all credentials accessible from affected build environments: GitHub tokens, AWS keys, Kubernetes service accounts, Vault tokens, npm tokens, and 1Password credentials
• Review npm audit logs and CI/CD execution logs for suspicious package installations and outbound network connections during build processes
• Implement package integrity verification using npm lock files and consider using private npm registries with package scanning
• Monitor for unauthorized access attempts using stolen credentials across GitHub, AWS, Kubernetes, and other targeted platforms