Socket: Mini Shai-Hulud Hits @antv Ecosystem

What it is

An active Mini Shai-Hulud npm supply chain compromise of packages tied to the npm maintainer account atool, spanning the @antv ecosystem. The summary gives the scale; this page gives the concrete indicators a defender needs to detect and scope exposure.

Named indicators (not in the summary)

• Exfiltration endpoint: https://t[.]m-kosche[.]com:443/api/public/otel/v1/traces — disguised as an OpenTelemetry traces path.
• Install hook: package.json is modified to add "preinstall":"bun run index.js"; a root-level obfuscated index.js runs at install.
• Decryptor marker: a custom decoder exposed via globalThis as fc2edea72.
• GitHub fallback: with a usable GitHub token, the payload creates a repo under the victim account and commits stolen data to results/results-<timestamp>-<counter>.json. Repos follow a <word>-<word>-<3 digits> Dune-themed pattern (e.g. sayyadina-stillsuit-852, harkonnen-phibian-552).
• Campaign marker string: repo descriptions contain niagA oG eW ereH :duluH-iahS — reverse of "Shai-Hulud: Here We Go Again". A GitHub search for the reversed phrase niaga og ew ereh :duluh-iahs currently returns ~1.9k repos.

Affected packages named

echarts-for-react (~1.1M weekly downloads), @antv/g2, g6, x6, l7, s2, f2, g, g2plot, graphin, data-set; plus timeago.js, size-sensor, canvas-nest.js. The 5/19 wave also touched packages under @lint-md, @openclaw-cn, and @starmind. Only accounts that auto-pull new dependency versions are exposed; pinned lockfiles that predate the wave are not.

What to do

The page states no fixed versions or commands, but the indicators support concrete action:

• Block/alert on outbound connections to t.m-kosche.com.
• Grep dependency trees and lockfiles for the affected packages installed at versions published in the wave window (publishes ~01:56–02:56 UTC on 5/19).
• Search your GitHub org for repos matching the <word>-<word>-<3 digits> name pattern, a results/ directory, or the marker string — these indicate a token was stolen and used.
• Treat any exposed GitHub/npm/AWS/Kubernetes/Vault/SSH/Docker secrets in CI as compromised and rotate. The payload specifically targets GitHub Actions, GitLab CI, Travis, CircleCI, Jenkins, Azure DevOps, CodeBuild, Buildkite, AppVeyor, Bitbucket Pipelines, Drone, Semaphore, TeamCity, Bamboo, Bitrise, Vercel, Netlify, and Cloudflare Pages.

Caveats

Socket calls this a developing story — the full package/version list is not final. Detection was fast (median ~6.7 minutes from publish), so the exposure window for late auto-updaters is narrow but real. Stolen data is gzip + AES-256-GCM (key RSA-OAEP/SHA-256 wrapped), so network plaintext recovery is not feasible — detection must rely on the endpoint, install hook, and GitHub artifacts above.