Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV data visualization ecosystem, part of the ongoing Mini Shai-Hulud supply chain worm campaign. Here's what the malware does, how to detect exposure, and how to respond. Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Comp…

https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack

sha256:a82a7ea12e6bdd9b2fe89cd7a41d27b24e1ea29f5c3f064e63ade3bc7f928a34

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url3
ipv42
ipv60
sha11
domain25
sha2561
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	package.json	Open →
domain	package-lock.json	Open →
domain	setup.mjs	Open →
domain	runner.worker	Open →
domain	settings.json	Open →
domain	registry.npmjs.org	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports