Socket(@SocketSecurity):We published our technical analysis. The @antv payload includes worm-like npm propagation logic: validate stolen npm tokens, enumerate packages, inject the payload, bump versions, and republish under the compromised maintainer identity. This is why these attacks can move so fast. There are now 2.1k public GitHub repos using the reversed Shai-Hulud marker and Dune-themed names, showing the fallback path is active at scale.

Socket

@SocketSecurity

Socket is the #1# software supply chain security platform. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS. 👀 @npm_malware

Joined November 2021

4.6K Following 22.7K Followers

Socket@SocketSecurity

2026.05.19 04:31

We published our technical analysis. The @antv payload includes worm-like npm propagation logic: validate stolen npm tokens, enumerate packages, inject the payload, bump versions, and republish under the compromised maintainer identity. This is why these attacks can move so fast. There are now 2.1k public GitHub repos using the reversed Shai-Hulud marker and Dune-themed names, showing the fallback path is active at scale.

101

Forward to community

Most Popular Users