Security researchers report that an attacker published 637 malicious releases across 317 npm packages in 22 minutes; the affected packages collectively have more than 11 million monthly downloads. The compromised account was identified as "atool," and the injected code comes from the "Mini Shai-Hulud" toolkit — the same toolkit implicated in an SAP compromise three weeks earlier.
What the malware does
The malicious payload specifically targets AI coding agents such as Claude Code and Codex. It injects hooks that run at Claude Code SessionStart and at Codex startup, and it adds Visual Studio Code tasks with the "runOn: folderOpen" setting. These hooks allow the payload to execute as agent-enabled coding sessions start and to scan the environment for secrets.
During infection, the malware harvests a range of credentials and vaults, including:
- AWS credentials
- Kubernetes tokens
- SSH keys
- GitHub personal access tokens (PATs)
- 1Password and Bitwarden vaults
Exfiltration is disguised as OpenTelemetry traces so that the outbound data blends into existing observability traffic and is less likely to trigger standard alerts.
Notable affected packages
The report lists several high-download packages that many projects may depend on, for example:
- size-sensor — 4.2M downloads/month
- echarts-for-react — 3.8M downloads/month
- @antv/scale — 2.2M downloads/month
- timeago.js — 1.15M downloads/month
Researchers advise teams to inspect lockfiles (e.g., package-lock.json, pnpm-lock.yaml) for any of the compromised versions.
Persistence and command-and-control
The malware also establishes persistence by installing a LaunchAgent or systemd service named "kitty-monitor," which survives reboots. For command-and-control, the attackers use GitHub commit search as a dead-drop channel and poll it for RSA-PSS-signed commands.
Recommended actions
SafeDep has published the full list of all 317 compromised packages along with deobfuscated payloads and remediation steps. Recommended actions include:
- Auditing and updating dependency lockfiles
- Scanning systems for stolen credentials and unknown services
- Reviewing VS Code and AI-agent integrations, especially any automatic-start tasks
- Inspecting network traffic and OpenTelemetry traces for suspicious exfiltration patterns
Following SafeDep’s published IoCs and remediation guidance is advised for organizations seeking to assess and remove any infections.
Summary
In a 22-minute window attackers pushed hundreds of malicious package releases targeting AI coding agents, attempting wide-ranging credential theft and maintaining stealth and persistence. The SafeDep disclosure of affected packages and mitigation steps is a key resource for impacted users and organizations.
