SafeDep's security team analyzes npm and GitHub supply chain attacks, compromised packages, and malware in open source dependencies.
Commenters link its write-ups during npm compromises such as keyv, saying they hold detailed analysis and steps for checking and cleaning up affected systems.
Many of the malicious commits show as an author `github-actions <github-actions@github.com>`. Which means that they are authenticating as internal github CI/CD stuff and that there are so many of those that no possible automated tool can find the poison in the mountain of chaff.
So this is related to the Sept 2025 security breach of Github.
> The five repos carry 1,459 GitHub stars between them, mantine-datatable alone accounting for 1,225. Stars are a rough proxy for how many developers have the source checked out locally, which is the population this attack targets.
> Every commit: unsigned, github-actions identity, chore: update dependencies [skip ci], the same six-file footprint. A 49-second sweep across five repos is automation, not a human committing. This matches Shai-Hulud self-propagation: harvest a GitHub token with write access from a prior infection, then push the persistence payload into every repo the token can reach.
https://safedep.io/miasma-worm-ai-coding-agent-config-injection/
What it is doing:
https://safedep.io/config-files-that-run-code/
I'm not related to those guys. That's the simplest detailed explanation of what is happening that I've found.
We just analysed the payload. Technical details here: https://safedep.io/malicious-litellm-1-82-8-analysis/
We are looking at similar attack vectors (pth injection), signatures etc. in other PyPI packages that we know of.
This article[0] investigated the payload. It's a RAT, so it's capable of executing whatever shell commands it receives, instead of just stealing credentials.
[0]: https://safedep.io/axios-npm-supply-chain-compromise/
We have done the complete analysis and there are 32 packages share the same publishing pipeline.
https://safedep.io/redhat-cloud-services-hit-by-mini-shai-hulud-npm-worm/
For GitHub Actions, i found http://safedep.io/ to be helpful, not only it guard against known attacks, but also it has its own malware detection engine.
https://safedep.io/miasma-worm-ai-coding-agent-config-injection/ seems to describe the same symptoms, for what it's worth.