SlowMist Detects 'Mini Shai-Hulud' npm Worm Stealing CI/CD Keys and Crypto Wallet Data

According to blockchain security firm SlowMist, its threat monitoring system MistEye detected a sophisticated npm worm named ‘Mini Shai-Hulud’ spreading through developer projects including TanStack, UiPath, and DraftLab. The malware uses compromised GitHub credentials to publish packages disguised as legitimate updates, injecting a hidden script called router_init.js that runs silently in CI/CD environments like GitHub Actions. The worm targets CI/CD keys, cloud infrastructure credentials, and cryptocurrency wallet information, exfiltrating data via GitHub infrastructure. SlowMist advised affected projects to immediately scan CI/CD pipelines for router_init.js, rotate all exposed GitHub and cloud credentials, and monitor development environments for suspicious background activity.