The Mini Shai-Hulud worm,
and where the firewall stops it.
Between 01:39 and 02:06 UTC on May 19, 2026, a single stolen npm publish token pushed malicious versions of dozens of packages across the AntV namespace and several widely used test libraries. Each one ran a credential harvester before any user script. No CVE existed. Here is the timeline, and the moment CyberXYZ blocks it.
-
01:39 UTC
A stolen publish token goes live
A single compromised npm publish token starts shipping. The first trigger package,
jest-canvas-mock@2.5.3, looks ordinary, but it carries anoptionalDependenciesentry pointing at a raw GitHub commit hash. -
01:39 UTC · commit-level signal fires
A phantom commit drops the payload
The referenced commit (
github:antvis/G2#1916faa…) exists on no branch. npm resolves it, downloads it, and runs itspreparescript on install. CyberXYZ reads the reference at the commit level and flags a dropper that exists only to deliver code. -
01:44 UTC
A second trigger lands
size-sensor@1.0.4ships with the same phantom-commit technique. Two unrelated, widely used packages now both carry the dropper. -
01:56 UTC · script-scan signal fires
The namespace is flooded
A burst of 14 packages publishes at once, including
@antv/g6,@antv/scale,timeago.jsandecharts-for-react. Each embeds a roughly 500 KB obfuscatedindex.jswired to"preinstall":"bun run index.js", so it runs before any user script can inspect it. -
the verdict
BLOCK, at install time
Across every surface, installing any affected version through the proxy returns
403, CI gates fail, the editor flags it. The harvester never runs. No advisory needed, the lifecycle hook and the phantom commit are signal enough. -
on execution (had it run)
What it would have stolen
The payload enumerates the environment, hits the AWS metadata endpoint at
169.254.169.254, and harvests GitHub, AWS, GCP, Kubernetes, Vault and npm credentials, then exfiltrates them tot.m-kosche.comdisguised as OpenTelemetry traces on port 443. -
the novel part
Sigstore provenance forgery
On a CI runner the payload mints a fresh GitHub Actions OIDC token and signs through public Sigstore, producing a package that appears to carry a valid provenance badge with no genuine link to the project. A signature alone is no longer proof.
-
02:22 UTC · 43 minutes in
The first public disclosure lands
Endor Labs publishes the initial write-up; Socket Threat Research later counts 639 malicious versions across 323 packages in this wave alone. By then, every install had already been blocked at the door.
Not a takedown after the fact.
The receipt.
The moment the first poisoned version hit the proxy, every runner and laptop got the same verdict, on the lifecycle hook, before the harvester could touch a single credential.
jest-canvas-mock@2.5.3BLOCKEDgha/runner CI/CD LinuxinternalCRITICALsize-sensor@1.0.4BLOCKEDgitlab/runner CI/CD LinuxinternalCRITICAL@antv/g6· flagged buildBLOCKEDgha/runner CI/CD LinuxinternalCRITICALtimeago.js· flagged buildBLOCKEDdev laptop DEV macOSinternalCRITICALecharts-for-react· flagged buildBLOCKEDgha/runner CI/CD LinuxinternalCRITICALfig. 01 · proxy findings · every poisoned version blocked the moment it appeared
Blocked install: jest-canvas-mock@2.5.3 on gha/runner · GitHub Actions
A ~500 KB obfuscated index.js is wired to a preinstall hook (bun run index.js) so it executes before any user script.
optionalDependencies resolves to a raw GitHub commit that exists on no branch and only delivers the payload via the prepare hook.
Reads the AWS metadata endpoint 169.254.169.254 and harvests GitHub, AWS, GCP, Vault and npm secrets, exfiltrating to t.m-kosche.com.
Matches the Mini Shai-Hulud campaign: 639 malicious versions across 323 packages in this wave.
fig. 02 · install verdict · the XYZ score and the four signals that fired
Sources: CyberXYZ threat intelligence, with Endor Labs and Socket Threat Research disclosures (May 19, 2026). Full technical write-up on the CyberXYZ blog.