Mini Shai Hulud: @antv npm Supply Chain Attack & CI/CD Credential Theft

---
title: Potential NPM Supply Chain Credential Access
id: a8b9c0d1-2345-6789-abcd-ef1234567890
status: experimental
description: Detects npm or node processes accessing sensitive credential files on Linux, indicative of the Mini Shai-Hulud behavior or similar supply chain attacks.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/npm'
      - '/node'
  selection_target:
    CommandLine|contains:
      - '/.aws/credentials'
      - '/.aws/config'
      - '/.git-credentials'
      - '/.kube/config'
      - '/.vault-token'
      - '/.npmrc'
  condition: selection_parent and selection_target
falsepositives:
  - Legitimate DevOps tooling that requires reading its own configuration during a build (rare during npm install).
level: high
---
title: Suspicious Shell Spawn via NPM Install
id: b1c2d3e4-3456-7890-bcde-f12345678901
status: experimental
description: Detects npm install processes spawning shell commands (bash/sh), a common technique in malicious package scripts like Mini Shai-Hulud.
references:
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1195.002
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/npm'
    ParentCommandLine|contains: 'install'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts using install hooks (verify script content if possible).
level: medium

// Hunt for npm processes accessing credential files or spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("npm", "node") 
| where InitiatingProcessCommandLine contains "install"
| where FileName in ("sh", "bash", "cat", "curl", "wget") 
   or ProcessCommandLine has ".aws/" 
   or ProcessCommandLine has ".kube/" 
   or ProcessCommandLine has ".git-credentials"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for obfuscated install scripts in node_modules/@antv
SELECT FullPath, Mtime, Size
FROM glob(globs='node_modules/@antv/*/package.')
WHERE read_file(filename=FullPath, length=10000) =~ /install.*\$\(.*\)|install.*base64/i
   OR read_file(filename=FullPath, length=10000) =~ /curl.*http|wget.*http/

-- Scan for processes spawned by npm accessing sensitive directories
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Exe =~ 'npm' AND CommandLine =~ 'install'
  AND EXISTS(
      SELECT * FROM chain(pid=Pid) 
      WHERE Name =~ 'bash' OR Name =~ 'sh' OR Name =~ 'curl'
  )

#!/bin/bash
# Security Arsenal - Mini Shai Hulud Remediation Script
# This script assists in identifying vulnerable packages and forcing a clean update.

echo "[*] Scanning for @antv packages..."

# Find package. files and check for @antv dependencies
find . -name "package." -type f -exec grep -l "@antv" {} \; | while read -r file; do
  echo "[!] Potential @antv dependency found in: $file"
  dirname "$file"
done

echo "[*] Checking for compromised versions (Refer to Microsoft Blog for specific hashes)"

# If specific hashes are unavailable, force a clean install of the scope
# WARNING: This assumes the registry has been cleaned.
read -p "Do you want to force update @antv packages? (y/n) " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
  echo "[*] Removing node_modules and lock files for clean reinstall..."
  rm -rf node_modules package-lock. yarn.lock
  echo "[*] Reinstalling dependencies..."
  npm install
  echo "[*] Verifying integrity..."
  npm audit
fi

echo "[CRITICAL] MANUAL STEP REQUIRED: Rotate all credentials found in CI/CD environment variables and secrets managers (AWS, GitHub, K8s, Vault)."