Supply chain attack spreads via hacked atoolt NPM account

A fresh Mini Shai-Hulud supply chain attack has hit over 320 NPM packages, with the compromised maintainer account ‘atool’ publishing malicious versions across the @antv namespace, including timeago.js used by many projects. The incident also extended to GitHub Actions and a VS Code extension, with security researchers noting the attack propagated to other popular packages such as echarts-for-react, which has about 1.1 million weekly downloads.

According to Socket, roughly 639 malicious versions were published across data-visualisation, graphing, mapping, charting and React component ecosystems. Across the full campaign, 1,055 versions across 502 unique packages have been tracked, with NPM representing the overwhelming majority: 1,048 NPM versions across 498 unique NPM packages, plus 6 PyPI entries across 3 packages and 1 Composer package-version entry.

Wiz adds that the payloads include downloading Python code for remote execution, and StepSecurity describes how the stolen data is exfiltrated through GitHub repositories and a fallback server, with TeamPCP implicated as the likely operators.