22 minutes. Between 01:44 and 02:06 UTC on May 19, 2026, someone published 631 malicious versions across 314 npm packages. The vector was account takeover of the npm account atool, which maintained 547 packages. The packages had 16 million weekly downloads aggregated — echarts-for-react alone had 3.8 million per month. We analyzed the attack and the signal is clear: when the supply chain becomes the vector, your defense response time needs to be shorter than the attack time.
The scale: 22 minutes, 631 versions, 314 packages
The numbers are what scare by temporal density. In 22 minutes, 631 malicious versions were published across 314 npm packages. The attacker published inside legitimate packages, with versions bumped automatically — they did not create new packages, they infected existing ones.
The atool account maintained 547 packages. The affected packages summed 16 million weekly downloads aggregated. echarts-for-react alone had 3.8 million downloads per month. Each published version injected a preinstall hook that executed an obfuscated 498KB Bun script. Bun instead of Node was a deliberate choice to evade Node.js-based scanners.
The collection: 20 categories of credentials in a single script
The Bun script collected 20 categories of credentials: AWS keys, GitHub PATs, npm tokens, GCP, Azure, Kubernetes, SSH keys, Docker auth, database connection strings, Stripe keys, Slack tokens. Exfiltration used the GitHub API as a dead-drop — credentials were committed to attacker repos with Dune names, such as harkonnen-melange-742.
The Bun choice is not accidental. Traditional supply chain scanners are calibrated for Node.js. A different runtime evades known signatures, AST heuristics, and behavior patterns. When the defense assumes Node, the attacker uses Bun.
The persistence: workflow injection, AI hooks, and a dead-man switch
After collection came persistence. Workflow injection in GitHub Actions: a workflow called "Run Copilot" that dumped all secrets via toJSON(secrets). Hooks in AI agents: .claude/settings.json with a SessionStart hook executing node .claude/setup.mjs. Every time a dev opened a Claude Code session, the malware re-executed.
There was also a system daemon called kitty-monitor. And a dead-man switch: if the victim revoked the stolen GitHub token, the daemon executed rm -rf ~/. It is not just exfiltration — it is retaliation. The attacker turns defense into a destruction trigger.
The attribution: TeamPCP, UNC6780, and the Shai-Hulud lineage
The attack was attributed to TeamPCP, tracked as UNC6780 by Google Threat Intelligence Group. The next day, according to GitHub, the breach was confirmed: 3,800 private repositories exfiltrated, including github-mcp-server and github-oauth-proxy. TeamPCP offered the stolen repos for $50,000 — it was not a ransom, it was a sale. According to OpenAI, two corporate devices were compromised.
This is the most recent point in a lineage that began in September 2025. Original Shai-Hulud: 500 packages, self-replicating worm. Then 2.0: 796 packages. Then SANDWORM_MODE. Then Bitwarden CLI. Then TanStack. Then @antv. In earlier waves, the same group forged valid SLSA Build Level 3 provenance — malicious packages passed cryptographic verification. The case was cataloged as CVE-2026-45321, CVSS 9.6.
Provenance proves where it was built. It does not prove that it is safe.
The ecosystem: 454,600 malicious packages in 2025, 1.8 million by mid-2026
According to ecosystem data, 454,600 new malicious packages in 2025. 1.8 million cumulative by mid-2026. 96.6% on npm. The scale is not of one-off attacks — it is of industrialized operation.
According to npm, version 12 released in July 2026 turned install scripts off by default and began requiring staged publishing with human approval and 2FA. This helps against preinstall hooks, but does not solve account takeover or AI agent hooks. The defense needs to go beyond the registry.
Tech86 controls for supply chain with AI agents
When Tech86 implements supply chain controls for clients that use AI agents, the base principle is direct. No package.json or lockfile modified by an AI agent enters without a human merge gate. Sandbox without persisted credentials. Egress allowlist. PreToolUse hooks that require --ignore-scripts.
It is not paranoia. It is the minimum given an attacker who plants hooks in .claude/settings.json and workflow injection in GitHub Actions. The attack surface now includes the configuration of the AI agent itself.
Conclusion: your defense response time needs to be shorter than the attack time
22 minutes of publishing. 24 hours later, GitHub confirmed the breach. Your defense response time needs to be shorter than the attack time.
We repeat: provenance proves where it was built, not that it is safe. Install scripts off by default helps, but does not solve account takeover. The real defense is a human merge gate for AI agent changes, sandbox without persisted credentials, egress allowlist, and PreToolUse hooks requiring --ignore-scripts. At Tech86, we help companies implement exactly these controls — before the 22 minutes of the next attack arrive.