New Shai-Hulud malware wave compromises 600 npm packages
Shai-Hulud campaign injects malware into 600+ npm packages to steal developer credentials.
Threat actors published 639 malicious versions across 323 unique packages to npm on May 19, 2026, primarily targeting the @antv ecosystem (charting and visualization libraries). The malware steals GitHub, npm, cloud, Kubernetes, and CI/CD credentials, exfiltrating them via Session P2P network and GitHub repositories to evade detection. This is part of an ongoing Shai-Hulud campaign that began in September 2025 and now includes capabilities to forge valid Sigstore provenance attestations and establish persistence via VS Code and Claude Code configuration.
AI summary of the linked source. Not reviewed by an editor. How this works
Run @antv/g2?
Get an email when a new story names @antv/g2, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Shai-Hulud malware campaign successfully compromised 639 malicious npm package versions by exploiting trust in the package ecosystem, particularly targeting popular visualization libraries in the @antv ecosystem. The attackers demonstrated sophisticated techniques including credential theft across multiple platforms (GitHub, npm, cloud services, Kubernetes, CI/CD), evasion through P2P networks, and even forging Sigstore provenance attestations to appear legitimate. This attack highlights the critical vulnerability in software supply chains where developers automatically trust and install packages, making it essential for organizations to implement rigorous package validation and monitoring processes.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — filev2.getsession.org
- domain — t.m-kosche.com
- malware — Shai-Hulud