SlowMist detects high-risk npm worm "MiniShai-Hulud" that can steal CI/CD keys and encrypted wallet information

According to MistEye, a threat monitoring system owned by blockchain security agency SlowMist(@SlowMist_Team), a highly complex npm worm called "MiniShai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab. Attackers hijack GitHub credentials, release malicious software packages disguised as legal updates, and implant the hidden script router_init.js into them. They run silently in CI/CD environments such as GitHubActions, specifically stealing CI/CD keys, cloud infrastructure keys and cryptocurrency wallet information, and use GitHub's own infrastructure to transfer data. SlowMist has synchronized relevant threat intelligence (IOC) to customers, recommending that projects using affected software packages immediately check for the presence of router_init.js files in the CI/CD pipeline, rotate all exposed GitHub, cloud services and cryptocurrency certificates, and continue to monitor abnormal background activity in the development environment.