Post

🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @antv ecosystem. The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.

19/5/26, 2:58 am14 reposts39 likes

Socket

@socket.dev

19 May

This is a developing story. We’ve embedded the affected package list from Socket’s campaign page and will keep updating as more versions and payload details are confirmed. socket.dev/blog/antv-pa...

socket.devActive Supply Chain Attack Compromises @antv Packages on npm...Active npm supply chain attack compromises @antv packages in a fast-moving malicious publish wave tied to Mini Shai-Hulud.

Socket

@socket.dev

19 May

UPDATE: So far we've identified 639 compromised npm package versions across 323 unique packages in tonight’s Mini Shai-Hulud wave. That includes 558 versions across 279 unique @antv packages. Most were detected within ~6 minutes of publication. We also published our technical analysis.

Socket

@socket.dev

19 May

cc: @campuscodi.risky.biz @zackwhittaker.com @thehackernews.bsky.social @bleepingcomputer.com @theregister.com @heise.de @golemde.bsky.social

The Bear Radar 🎯

@stockmarketrotation.com

19 May

Catching those within six minutes is an impressive turnaround for that many packages. Was the antv volume coming from one specific account or was it more widespread?

Connor Shea

@connorshea.bsky.social

19 May

Is it possible they were compromised via the GitHub Actions issues-helper compromise earlier today? www.stepsecurity.io/blog/actions...

stepsecurity.ioactions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurityThe popular GitHub Action actions-cool/issues-helper has been compromised. Every existing tag in the repository has been moved to point to a single imposter commit that does not appear in the action's...

Connor Shea

@connorshea.bsky.social

19 May

This seems likely, even, lots of unpinned usages of the action that got compromised: github.com/search?q=org...

github.comBuild software better, togetherGitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

Connor Shea

@connorshea.bsky.social

19 May

actually, I think this is from a compromise of a specific GitHub user who happened to have elevated access to all of these packages / the GitHub Actions workflow that was compromised earlier? So it's not a compromise caused by the Actions compromise, at least I don't think so.