Time | Event | Significance |
04/29/2026 | The | Attackers (or third parties) knew how to exploit it early on. |
05/17/2026 | A fix is proposed via a Pull Request. | The fix has NOT been merged — leaving the exploitation window open for nearly 2 months. |
07/14/2026 | Date the attack takes place. | The vulnerability still exists on production. |
Time (UTC) | Stage | Action | Technical Details | Impact |
05:08 | Stage 0 — Credential Theft | Opened 37 Pull Requests to the | One PR contained obfuscated JavaScript designed to execute in the | Created "noise" to hide the PR containing the actual malicious code. |
05:08 – 06:57 | Stage 0 — Credential Theft | CI/CD workflow triggered, exfiltrated the release bot's token |
| Attacker obtained a legitimate npm publish token. |
06:58 | Stage 1 — Code Injection | Pushed malicious commit to the | Used the stolen token to push directly into the repo. | Triggered the legitimate release pipeline. |
07:10 | Stage 1 — Package Publish | Published 3 generator packages to npm | The |
|
08:06 | Stage 1 — Package Publish | Published | Same legitimate pipeline mechanism. | The package with ~2.7M weekly downloads began distributing malware. |
08:30 | Stage 1 — Package Publish | Published | Additional alpha version published. | Expanded the blast radius to include early adopters. |
08:30 – 11:18 | Stage 2 — Active Exploitation | Malware executed on victim's machine upon | Spawned a detached Node.js process → downloaded | Developers and CI/CD runners infected when building/testing with the new packages. |
~11:18 | Response | Unpublished all 5 versions from the npm registry | AsyncAPI team responded after receiving alerts. | Stopped malware distribution via npm. |
Name | Tracking Source / Description |
PCP | Primary name, used by OX Security, JFrog, Snyk |
DeadCatx3 | Alias on underground forums |
PCPcat | Variant name on some trackers |
ShellForce / CipherForce | Alias tracked by some threat intelligence firms |
CanisterWorm | Name based on worm technical characteristics |
Time | Campaign | Target | Main Technique | Scale / Impact |
09/2025 | Shai-Hulud (Original) | General npm ecosystem | Self-replicating npm worm, install-time hooks ( | Hundreds of packages infected; marked the turning point from typosquatting to automated worms. |
04–05/2026 | Mini Shai-Hulud (Wave 1) | TanStack, Mistral AI, Guardrails AI, UiPath | GitHub Actions "pwn request" + cache poisoning + OIDC token theft → published packages with valid SLSA Build Level 3 provenance. | First time in history: valid provenance was weaponized. |
05/12/2026 | Open-source Shai-Hulud | Hacker community | TeamPCP published the worm's source code on forums. | Turned a proprietary tool into "commodity malware" — anyone could create variants. |
05/18/2026 | Megalodon (Wave 2) | GitHub repositories | Pushed over 5,000 malicious commits to repos for large-scale secret exfiltration. | Brute-force attack on source code infrastructure. |
05/19/2026 | Wave 5 |
| Automated attack. | 600+ packages compromised in 22 minutes. |
06/2026 | Miasma — Red Hat |
| "Phantom Gyp" (malicious | Dozens of Red Hat packages infected; credential stealers injected into frontend libraries. |
06/2026 | Miasma — LeoPlatform | LeoPlatform / RStreams | Phantom Gyp + Bun loaders, bypassed Node.js security tools. | Serverless data pipeline compromised. |
07/14/2026 | AsyncAPI (this analysis) |
| CI/CD pwn request → import-time execution (bypassed | Biggest evolution: no install hooks required, bypassed npm v12. |
Check / Condition | Action if TRUE |
Running in a Virtual Machine (VM) | Terminate |
EDR / Endpoint Protection detected | Terminate |
System locale/language is Russian | Terminate |
Security Measure | Status | Reason / Details |
| Ineffective | Malware does not use install hooks; it executes upon |
npm Provenance / SLSA Attestation | Bypassed | The package was published via a legitimate CI/CD pipeline → the attestation is valid. |
SCA (Software Composition Analysis) | Not detected | Newly published version → not yet in threat intelligence databases. |
npm v12 post-install block | Not applicable | Attacker embedded the code directly into the main JS file, no post-install script needed. |
Lockfile pinning ( | Partial protection | Only protects if a safe version is already pinned; does not protect during new |
Tactic | Technique ID | Technique Name | Application in Campaign |
Reconnaissance | T1595 | Active Scanning | Attackers scan public repositories to find GitHub Actions misconfigurations (especially the abuse of the |
Initial Access | T1190 | Exploit Public-Facing Application | Exploited the |
Initial Access | T1195.002 | Supply Chain Compromise: Compromise Software Dependencies | Embedded malicious code directly into the main JavaScript file of npm packages, distributed through official release channels. |
Execution | T1204.002 | User Execution: Malicious File | Malware executes when developers or CI/CD systems import/require the infected library packages. |
Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Executed system scripts to configure hidden background processes. |
Execution | T1059.004 | Command and Scripting Interpreter: Unix Shell | Ran shell scripts on macOS/Linux to set up the malware. |
Persistence | T1543.003 | Create or Modify System Process: Systemd Service | Created a systemd service named |
Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Overwrote the Run key in the Windows Registry and modified shell startup files ( |
Defense Evasion | T1140 | Decompile, Decrypt, or Deobfuscate Files/Information | Decrypted the encrypted loader file |
Defense Evasion | T1497.001 | Virtualization/Sandbox Evasion: System Checks | Checked if the system is running in a virtualized environment (VM) or analysis sandbox to self-terminate. |
Defense Evasion | T1497.003 | Virtualization/Sandbox Evasion: Time-based Evasion | Checked the system locale/language (Russian) to evade EDR/Sandbox detection and self-terminate. |
Defense Evasion | T1036 | Masquerading | Named malware storage directories to masquerade as legitimate Node.js system directories (e.g., |
Credential Access | T1555 | Credentials from Password Stores | Collected saved passwords from popular web browsers on the victim's machine. |
Credential Access | T1552.001 | Unsecured Credentials: Private Keys | Scanned and collected SSH private keys stored on disk. |
Credential Access | T1552.004 | Unsecured Credentials: Private Information in Cloud / Code | Searched for authentication tokens of npm, PyPI, Cargo, GitHub, and Cloud configuration credentials (AWS, GCP, Azure). |
Discovery | T1082 | System Information Discovery | Queried system configuration information, time zone, and locale language to check geofilters. |
Command and Control | T1071.001 | Application Layer Protocol: Web Protocols | Used HTTP/HTTPS over ports 8080/8081/8091 to connect to the main C2 at |
Command and Control | T1568 | Dynamic Resolution | Leveraged the Nostr protocol, IPFS Gateways, and Ethereum smart contracts to resolve and fallback to C2. |
Command and Control | T1105 | Ingress Tool Transfer | Downloaded the next payload file ( |
Command and Control | T1043 | Commonly Used Port | Used standard BitTorrent DHT ports for beaconing communication to bypass firewalls. |
Exfiltration | T1048 | Exfiltration Over Alternative Protocol | Exfiltrated stolen sensitive data through P2P backup channels and BitTorrent DHT. |
Impact | T1496 | Resource Hijacking | Deployed secondary features related to crypto-stealers (draining funds from crypto wallets) and RATs for resource hijacking. |
Impact | T1565 | Data Manipulation | Automatically modified library packages managed by the victim on npm/PyPI/Cargo to self-replicate. |