The intercom-client npm package version 7.0.4 was compromised through a malicious GitHub account (nhur), which created malicious workflows to automate CI publishing of the infected package. The attack deployed two malicious files: setup.mjs, executed via a preinstall hook to download an unverified Bun binary, and router_runtime.js, an obfuscated 11.7 MB script designed to steal credentials from Kubernetes, Vault, and cloud environments. The stolen credentials were encrypted and exfiltrated through the GitHub API. This compromise shares technical patterns with recent supply chain attacks on PyPI lightning and SAP CAP packages, attributed to the TeamPCP threat actor group. The attack specifically targeted developers and CI/CD environments that installed the compromised package, enabling credential theft and potential further compromise of cloud and Kubernetes infrastructure.

The compromise of the intercom-client npm package introduced credential-stealing malware into a widely used Node.js SDK with approximately 360,000 weekly downloads. This malware targets Kubernetes, Vault, and cloud credentials, potentially exposing sensitive infrastructure secrets. The stolen data is encrypted and exfiltrated via the GitHub API, enabling attackers to gain unauthorized access to cloud and CI/CD environments. The attack affects developers and automated CI/CD pipelines that installed the compromised package, increasing the risk of widespread credential theft and subsequent infrastructure compromise. No known exploits in the wild are reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation links are provided, users and organizations should avoid using intercom-client npm package version 7.0.4 until further notice. Review and audit CI/CD workflows and GitHub accounts for unauthorized access or malicious workflows, especially the compromised account 'nhur'. Consider scanning installed packages for the known malicious file hashes provided. Monitor for suspicious activity related to credential access and exfiltration. Follow updates from the package maintainers and trusted security sources for official fixes or mitigation instructions.