Mini Shai-Hulud Compromises @antv npm Packages to Steal CI/CD Credentials

Mini Shai-Hulud is a sophisticated supply-chain attack that compromised the @antv npm account to publish malicious packages which executed during npm install via preinstall hooks; the obfuscated ~499 KB JavaScript payload targeted GitHub Actions environments and stole credentials across AWS, HashiCorp Vault, Kubernetes, npm, and 1Password, exfiltrating data via encrypted HTTPS to a C2 and by creating GitHub commits. Microsoft researchers reported the campaign, GitHub removed hundreds of malicious packages and invalidated tens of thousands of npm tokens, and IoCs (SHA-256s, domains, filenames) and mitigation steps (ignore-scripts, pinning, credential rotation, audit repos) were provided.