Shai-Hulud Returns: Massive npm Supply Chain Attack Hijacks AntV Ecosystem to Scrape GitHub Runner Memory

StepSecurity reports a massive, coordinated npm supply-chain campaign on May 19, 2026 that hijacked the atool publisher (including timeago.js and AntV packages) to distribute a heavily obfuscated JavaScript worm. The worm uses a two-wave publish strategy and multiple injection patterns to run a payload that hunts GitHub Actions runner memory for secrets, harvests credentials across cloud and developer tooling, escalates privileges, persists in developer workflows, and exfiltrates data via commits to a legitimate repository or a TLS C2, with evidence of thousands of automated malicious repositories being created.