Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password platforms. The post Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft appeared first on Microsoft Security Blog . Micro…

https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft

sha256:b2b06901d51e0f71b17a56de80864ef582b1aec7af78386993440b387e45acdb

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md51
url1
ipv43
ipv60
sha11
domain17
sha2563
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	package.json	Open →
domain	package-lock.json	Open →
domain	json.stringify	Open →
domain	runner.worker	Open →
domain	process.env	Open →
domain	yarn.lock	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports