Socket: Mini Shai-Hulud

What it is

Socket's report on npm's May 19 platform-wide invalidation of every granular access token with write access that bypasses 2FA, triggered by a Mini Shai-Hulud wave (attributed to TeamPCP). The summary covers the campaign scope; what it can't carry is the operational detail an engineer needs to decide whether migrating to Trusted Publishing actually helps.

What to do

npm's stated action for maintainers: update stored tokens and rerun any automation that uses them — anything relying on a bypass-2FA token stopped working on May 19. npm points to OIDC Trusted Publishing as the replacement. Relevant shipped state if you go that route:

• Bulk trusted-publishing config reached GA in npm CLI v11.10.0 (February).
• CircleCI joined GitHub Actions and GitLab CI/CD as a supported OIDC provider (April).

Preconditions / Affected

Any maintainer using long-lived bypass-2FA tokens in CI/CD. Directly hit in the triggering wave: the @antv ecosystem, echarts-for-react (~1.1M weekly downloads), timeago.js, size-sensor, canvas-nest.js — 639 malicious versions across 323 packages via the hijacked atool account.

Caveats — why the reset and Trusted Publishing may not cover you

The report's core argument, and the reason to read past the summary: the token reset "does not close the underlying hole." The worm is still active and simply re-harvests newly issued tokens.

More importantly, the most damaging recent attacks needed no long-lived token and walked straight through Trusted Publishing:

• TanStack (May 11): attackers minted publish tokens through the project's legitimate OIDC trusted-publisher binding — abusing a pull_request_target Pwn Request, Actions cache poisoning, and pulling an OIDC token from runner memory, then POSTing to npm directly.
• Bitwarden CLI (Apr 23): payload shipped by compromising the publish-ci.yml workflow itself.

Trusted Publishing's own documented gaps: it cannot publish a new package, and it has no human-approval step at publish time. OpenJS declined to recommend it for critical projects. So Trusted Publishing raises the bar against stolen static tokens but does not stop CI/CD pipeline compromise or OIDC-binding hijack — match the control to your risk profile rather than treating migration as a fix.

flowchart TD
    W[Mini Shai-Hulud on runner] --> T[Steal bypass-2FA token]
    T --> R[May 19 reset cuts this path]
    W --> P[Compromise CI pipeline / OIDC binding]
    P --> Pub[Publish via legit trusted-publisher]
    R -.does not block.-> Pub
    style R fill:#cfc
    style Pub fill:#fcc