Security researchers have identified an active, highly sophisticated supply chain attack targeting the widely used @antv node package manager (npm) package ecosystem. A threat actor successfully compromised an official @antv maintainer account to publish malicious versions of foundational data-visualization packages, instigating a severe cascading downstream infection vector. This compromise rapidly propagated through interconnected dependency chains into massive open-source libraries, most notably echarts-for-react—which commands over one million weekly downloads—expanding the operational blast radius deep into enterprise CI/CD pipelines and production cloud workloads across the global ecosystem. The malicious mechanism driving this campaign is a stealthy, ~499 KB obfuscated JavaScript file designed to run completely silently during routine npm install operations, systematically targeting and stealing sensitive environment secrets. The attack proceeds through a structured, multi-stage path: it achieves initial downstream dependency amplification via packages like echarts-for-react and size-sensor, then abuses automated package lifecycle scripts via a preinstall hook to execute an execution chain running from node to shell, and finally to the Bun runtime (automatically installing Bun on the host machine if it is absent) to execute the core payload.

To bypass initial static analysis and automated security scanners, the threat actors completely replaced the legitimate package entry point (index.js) with a single-line, heavily obfuscated script split into two distinct structural layers. Layer 1 utilizes 1,732 Base64-encoded strings housed within a rotated array, which are dynamically decoded at runtime via a specialized lookup function matching the shuffle key 0xa31de. Layer 2 implements a custom PBKDF2 and SHA-256 cipher mechanism to encrypt high-value configuration metadata, such as command-and-control (C2) domains and targeted environment variables, ensuring they are only decrypted in memory during execution. Furthermore, strict environment gating dictates that the payload immediately terminates if it detects that it is not running on a Linux-based GitHub Actions runner, while advanced branch avoidance filters skip critical developer branches like main, master, dependabot/, renovate/, and gh-pages during Git API operations to evade detection by automated repository monitoring systems.

Multi-Platform Credential Harvesting and Memory Scraping

Once operational within a target environment, the payload’s primary capability transitions to comprehensive multi-platform credential harvesting across six vital technology infrastructure pillars. Within GitHub environments, it extracts the native GITHUB_TOKEN, scans process environments for Personal Access Tokens (gho_, ghp_) or installation tokens (ghs_), validates them via the official /user API, and maps available repository and organization secrets. On Amazon Web Services (AWS), the malware executes deep internal discovery by querying the local Instance Metadata Service (169.254.169.254) and Elastic Container Service metadata endpoints (169.254.170.2), parsing host .aws/ configuration files, harvesting environment variables, and actively querying the AWS SecretsManager globally across all available regions. Simultaneously, it targets HashiCorp Vault instances by scanning over 12 common token paths—such as /var/run/secrets/vault/token and ~/.vault-token—and attempts direct local connections to running Vault daemons at 127.0.0.1:8200. For the npm registry ecosystem, tokens are verified using the /-/whoami endpoint, and OpenID Connect (OIDC) tokens are actively leveraged to exchange configurations for unauthorized package publishing rights. Lastly, the payload targets Kubernetes clusters by exfiltrating service account tokens to enumerate namespace secrets, while interacting directly with the 1Password command-line interface (CLI) to attempt master password extraction alongside two-factor authentication (2FA) bypass techniques.

Crucially, the payload is capable of bypassing normal security controls and secret masking mechanisms by reading data directly from raw runner process memory space. It actively scans the Linux /proc directory to isolate the specific process identifier (PID) associated with the active GitHub Actions Runner.Worker process. Once identified, it parses the process memory via /proc/<pid>/cmdline and pipes the raw, unmasked data streams through a precise regular expression filter.

By scraping unmasked runtime secrets directly from the runner’s memory space, this activity entirely neutralizes standard CI/CD logging and masking protections.

Privilege Escalation, Exfiltration Channels, and Containment

The malware further ensures control over the compromised runner by executing local privilege escalation and establishing persistence. It injects a passwordless sudoers rule (runner ALL=(ALL) NOPASSWD:ALL) via a bind mount at /mnt/runner and alters the local /etc/hosts file for strategic local DNS redirection. Exfiltration of the harvested credentials follows a highly resilient, three-tier dual-channel architecture. The primary channel leverages secure HTTPS communication (port 443) back to an encrypted C2 domain after executing strict DNS pre-checks and health probes. If blocked, the secondary fallback channel leverages the native Git Data API to programmatically construct blobs, trees, and commits directly inside the victim’s repositories on unprotected branches. As a tertiary mechanism, the payload programmatically generates public repositories under the victim’s profile using the reversed string description "niagA oG eW ereH :duluH-iahS"; over 2,200 of these rogue repositories have already been identified in the wild.

To sustain prolonged access, the malware enumerates /user/repos and /user/orgs to spread into additional repositories, deploys an ongoing token monitor for continuous credential capture, and actively forges Supply chain Levels for Software Artifacts (SLSA) provenance attestations through Sigstore frameworks (Fulcio and Rekor) to make compromised builds appear legitimate. Upon identifying this widespread exploitation vector, GitHub responded rapidly to limit further cascading damages. The platform proactively removed 640 distinct malicious package versions from the registry while invalidating 61,274 granular npm access tokens that possessed write permissions and 2FA bypass vulnerabilities. Furthermore, security advisories were published directly within the GitHub Advisory Database, prompting immediate notification downstream through automated Dependabot alerting systems and npm audit mechanisms to contain further risk.

Technical Mitigations and Protection Blueprint

To defend against this campaign, security teams should immediately enforce the following protections recommended by Microsoft:

• Dependency Auditing: Review direct and transitive dependency trees for affected @antv/ package versions and isolate any instances built or installed during the exposure window.
• Version Pinning: Lock down known-good package configurations and completely freeze automatic or dynamic upstream dependency upgrades until validation is finished.
• Disable Installation Scripts: Execute all dependency updates using the npm install --ignore-scripts flag to natively disable compromised preinstall or postinstall hooks.
• Credential Lifecycle Management: Rotate all potentially exposed credentials, CI/CD secrets, cloud keys, and npm write tokens across development estates.
• Repository & Log Audits: Scan GitHub accounts for unauthorized public repositories matching the description "niagA oG eW ereH :duluH-iahS" and audit CI/CD logs for anomalous outbound network calls or suspicious package lifecycle activity.
• Endpoint & Vulnerability Protection: Employ automated security solutions like Microsoft Defender XDR and Vulnerability Management to continually audit lockfiles, track package states, and identify compromised @antv packages across the environment.

Our Take: The Industrialization of Supply Chain Malware

This @antv supply chain campaign represents a watershed moment in open-source ecosystem exploitation, shifting from opportunistic script injections to highly industrialized infrastructure hijacking. The most alarming aspect of this attack is not merely the wide net cast by targeting visualization frameworks embedded across enterprise dashboards, but the surgical focus on cloud environments and CI/CD pipelines. By weaponizing process memory scraping to bypass native secret masking mechanisms, the threat actors demonstrated a profound understanding of modern engineering environments.

Furthermore, the forgery of SLSA provenance attestations using Sigstore frameworks hits the open-source community where it hurts most: trust. Code attestation frameworks were designed specifically to guard against supply chain poisoning, yet this malware shows that even security signatures can be subverted if upstream developer identities are compromised. As software development increasingly relies on automated workflows, this incident proves that a single compromised maintainer token can impact entire corporate infrastructures. Moving forward, organizations must abandon implicit trust models, strictly enforce --ignore-scripts configurations, and treat build runners as hostile execution boundaries.