{
  "Event": {
    "analysis": "1",
    "date": "2026-04-30",
    "extends_uuid": "",
    "info": "[Threat Intel] Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise",
    "protected": false,
    "publish_timestamp": "1779546259",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1779546259",
    "uuid": "ee5f2938-ac20-4495-addd-86cedd388770",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Shai-Hulud\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950021",
        "to_ids": false,
        "type": "link",
        "uuid": "a665602c-a685-4ee9-b6ff-d242a7ea6db8",
        "value": "https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950021",
        "to_ids": false,
        "type": "text",
        "uuid": "a89b0ee5-4a66-4e96-9b67-bc3e6aafe83b",
        "value": "A malicious artifact of the widely-used intercom/intercom-php package version 5.0.2 was discovered on Packagist, representing an expansion of the Mini Shai-Hulud supply chain attack from npm into the PHP ecosystem. The compromised package exploits Composer plugin execution to download Bun runtime and execute an obfuscated credential-stealing payload during installation. The malicious code harvests sensitive credentials including GitHub tokens, cloud provider credentials, SSH keys, Kubernetes tokens, and HashiCorp Vault secrets from developer machines and CI/CD environments. Stolen data is encrypted using AES-256-GCM and exfiltrated to attacker-controlled infrastructure. The payload also contains propagation logic to modify GitHub repositories and npm packages using stolen credentials. With approximately 12,700 daily installs, the compromised artifact potentially reached numerous high-value development environments before removal."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950021",
        "to_ids": false,
        "type": "text",
        "uuid": "88c34685-5424-4775-93d6-66081ee3878d",
        "value": "Name: Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise\nAuthor: AlienVault\nAdversary: \nTags: [\"credential theft\", \"mini shai-hulud\", \"supply chain attack\", \"intercom\", \"packagist compromise\"]\nTgtd countries: []\nMlwr families: [\"router_runtime.js\"]\nAttack_ids: []\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546247",
        "to_ids": true,
        "type": "sha1",
        "uuid": "d95883d8-7548-48f2-bb77-5e6fed871bf9",
        "value": "e69bf4b3e84e7951a7b4ded8fee8822c57630cf8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546249",
        "to_ids": true,
        "type": "sha1",
        "uuid": "68238de9-25e4-4ec6-ae3f-b4ea3d3180b6",
        "value": "e8a812c5ea7d8c7ed642b0d82754ced6a99025b0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546251",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ed5417df-1527-4632-9a60-3bd894df2ab2",
        "value": "50212a875643520353df158196b9b3be4595094125ad8d2d2c48bdd9cb04ce1f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546253",
        "to_ids": true,
        "type": "sha256",
        "uuid": "cc9b68ad-fcbb-4994-88f0-4165d10e7d52",
        "value": "66664a49edbcee0ed0d8365839707916e92d3aa06e7f26f33c9dcc58e5fc1ef3",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546255",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ef20c684-cd14-4441-8bba-a0f15c818388",
        "value": "832a976d1a8d54e296e8479aedbd89fa24baa02b8409a78bf06d4d03340881bd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546257",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ffb85b06-ad94-4585-ac3f-529305056e16",
        "value": "907aec5b1288057a3e0885226918b6930a62a0f348ce23de026a683238c7903e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:08/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779546259",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e161c53a-fddf-4969-abb8-93e47e21621f",
        "value": "b084743bd16043461e68b604dde80a8b386b405eae6f66c1103fb4fd6831d4a7",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778209763",
        "to_ids": true,
        "type": "url",
        "uuid": "4f9b2339-989c-4bfd-920f-ce1192ce0e9b",
        "value": "https://zero.masscan.cloud:443/v1/telemetry",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778209785",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c40a451d-b495-430c-8423-76025e36efd3",
        "value": "zero.masscan.cloud",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Strings for Threat Hunting",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1778203908",
        "to_ids": false,
        "type": "text",
        "uuid": "28fc7f33-8b3f-40a5-9bb7-cd1dc915aa48",
        "value": "Running Intercom setup script...\r\nIntercom setup complete.\r\nIntercom\\\\\\\\ComposerPlugin\r\nrouter_runtime.js\r\nsetup-intercom.sh\r\nA Mini Shai-Hulud has Appeared\r\nEveryBoiWeBuildIsAWormyBoi\r\nExiting as russian language detected!\r\nchore: update dependencies\r\nclaude@users.noreply.github.com\r\npackage-updated.tgz"
      }
    ]
  }
}