Mini Shai-Hulud Worm (Apr–May 2026)

What it is

A confirmed npm supply-chain compromise: intercom-client@7.0.4, the official Intercom Node.js SDK (~360,000 weekly downloads, 100+ dependent projects), was published with malware as part of the "Mini Shai-Hulud" worm campaign. The prior release 7.0.3 (published 88 days earlier) is clean.

How it works

Version 7.0.4 added two files absent from 7.0.3: setup.mjs and router_runtime.js. A preinstall hook runs setup.mjs, which downloads and executes an unverified platform-specific Bun binary from GitHub Releases with no integrity checks. That binary runs router_runtime.js, an 11.7 MB obfuscated payload that harvests Kubernetes and Vault credentials from environment variables and local files, then encrypts and exfiltrates them via the GitHub API. The payload is nearly identical to the one in the lightning@2.6.2 PyPI attack.

Preconditions / Affected

Any developer machine or CI/CD pipeline that ran npm install resolving intercom-client@7.0.4. Critically, because the malicious code executes during installation via preinstall, systems are exposed even if the package was never imported or used in application code.

What to do

Per Socket's guidance:

• Immediately remove intercom-client@7.0.4 and downgrade to a known-good version (7.0.3 predates the compromise).
• Rotate potentially exposed credentials.
• Review any system where the package may have been installed.
• Prioritize environments holding Kubernetes credentials, Vault tokens, cloud credentials, or GitHub tokens.

For GitHub-side detection, the compromise used a hijacked account (nhur) that on April 30, 2026 created branches mimicking Dependabot naming but with a typo (e.g. dependabout/github_actions/...), pushed workflow files (e.g. .github/workflows/format-check.yml) that read ${{ toJSON(secrets) }} and wrote secrets to files uploaded as Actions artifacts, and used spoofed but unsigned commit identities (dependabot[bot], claude). The malicious npm publish itself came from a "Test Commit" that deleted ci.yml and added a test.yml workflow named dependabot/fix, triggering an automated publish workflow. Follow-on CI commits added files under .claude/ and .vscode/. Audit for these artifacts.

Caveats

Socket states it is still analyzing whether this is part of the same TeamPCP campaign as the SAP CAP / Cloud MTA compromise, a direct follow-on, or a copycat reusing the tooling — attribution is not settled. The TeamPCP link to the related SAP CAP campaign rests on shared payload patterns and overlap with prior Checkmarx, Bitwarden, Telnyx, LiteLLM, and Trivy incidents, not on definitive attribution of this specific package.