Overview
- The campaign began when attackers took over a maintainer's GitHub account and, on Tuesday, August 4, 2026, pushed commits that added setup.mjs, Math_Symbol.js and a preinstall hook to keyv and related packages.
- setup.mjs downloads the Bun runtime from GitHub and launches the heavily obfuscated Math_Symbol.js payload, which scans for npm tokens, GitHub tokens, cloud keys, Vault and Kubernetes secrets, private keys and other credentials before encrypting and exfiltrating them.
- After validating stolen tokens, the malware uses npm and GitHub credentials to inject the same loader into packages it can reach, increment versions and republish, producing a worm‑like spread with vendor counts ranging from several hundred to more than 1,300 affected packages and thousands of malicious versions.
- Researchers urge immediate response steps: isolate hosts that ran the preinstall, preserve logs and artifacts, rebuild compromised runners and workstations before cleanup, and rotate or revoke exposed tokens only after containment to avoid triggering the attacker's dead‑man watcher.
- The campaign builds on public Mini Shai‑Hulud code and highlights a key weakness in provenance: releases published through legitimate GitHub Actions carried valid attestations that prove build origin but not source safety, prompting calls for allowlisting, integrity checks and tighter dependency controls.