[email protected] contains malicious code introduced by the Shai-Hulud threat actor. Upon installation, a preinstall hook downloads the Bun runtime and executes a payload that extracts GitHub credentials via the 'gh auth token' command. The attacker uses GitHub's commit search API as a covert command and control channel by querying for specific strings in public repositories, allowing the attack to evade detection by blending with legitimate traffic. This behavior aligns with previous Shai-Hulud campaigns that exhibit worm-like propagation by leveraging stolen credentials to compromise additional npm packages. The package's high download volume increases the potential impact of this supply chain compromise.

The compromise allows attackers to steal GitHub credentials from users installing the affected package, potentially exposing sensitive repositories and credentials. The worm-like behavior of the threat actor could lead to further infections of npm packages, amplifying the supply chain risk. The use of legitimate GitHub APIs for command and control complicates detection and response efforts. No known exploits in the wild have been reported yet, but the risk remains significant due to the package's popularity.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory or official sources for updates. Until a fix is available, avoid using Intercom-client version 7.0.4. Review and rotate any GitHub credentials that may have been exposed. Monitor for suspicious activity related to GitHub tokens and npm package installations. Consider using package integrity verification and supply chain security tools to detect compromised packages.