Malicious code in @ornikar/intl-config (npm)
The npm package @ornikar/intl-config versions 10.0.2 through 10.0.10 were compromised as part of a large-scale npm supply-chain worm campaign in August 2026. The malicious versions include a preinstall hook that downloads and executes an obfuscated Bun runtime payload which steals a wide range of credentials and secrets from the infected environment. This payload propagates by republishing other packages accessible via stolen npm tokens, causing widespread contamination. Any environment that installed these versions with install scripts enabled should be considered fully compromised, requiring immediate credential rotation and removal of the package.
AI Analysis
Technical Summary
The @ornikar/intl-config npm package was trojanized during the "Shai-Hulud: Here We Go Again" supply-chain worm wave on August 4, 2026. A preinstall lifecycle hook was added that downloads a standalone Bun runtime and executes a heavily obfuscated ~728 KB Bun-CJS payload (math_init.js). This payload harvests credentials from GitHub, npm, cloud providers (AWS, GCP, Azure), HashiCorp Vault, Kubernetes, CI/CD secrets, and private keys, then uses stolen npm tokens to republish further packages with the same malicious hook. The attack uses an alternate-runtime dropper pattern to evade Node-based supply-chain scanners. The package's legitimate purpose does not require such a runtime, confirming malicious intent. The worm poisoned over 400 packages across multiple organizations in a short time window.
Potential Impact
Installation of affected versions results in execution of attacker-controlled code during npm install, leading to full compromise of the environment. The payload steals a broad range of credentials and secrets, including cloud keys and CI/CD tokens, enabling attackers to escalate access and propagate the worm further. Any system that installed these versions with install scripts enabled is considered compromised, with potential exposure of sensitive organizational secrets and infrastructure.
Mitigation Recommendations
No official patch or remediation is indicated in the provided data. The vendor advisory is not available, so patch status is not confirmed—check the vendor advisory for updates. Immediate actions include removing the affected package versions, rotating and revoking all credentials and secrets accessible from the compromised environment (npm tokens, GitHub tokens, cloud provider keys, Vault/Kubernetes secrets, CI/CD secrets), and treating any environment that installed these versions with install scripts enabled as fully compromised. Because the payload executes during install via an alternate runtime, standard Node.js supply-chain scanners may not detect it. Full system compromise means remediation may require rebuilding affected systems from clean sources.
Malicious code in @ornikar/intl-config (npm)
Description
The npm package @ornikar/intl-config versions 10.0.2 through 10.0.10 were compromised as part of a large-scale npm supply-chain worm campaign in August 2026. The malicious versions include a preinstall hook that downloads and executes an obfuscated Bun runtime payload which steals a wide range of credentials and secrets from the infected environment. This payload propagates by republishing other packages accessible via stolen npm tokens, causing widespread contamination. Any environment that installed these versions with install scripts enabled should be considered fully compromised, requiring immediate credential rotation and removal of the package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @ornikar/intl-config npm package was trojanized during the "Shai-Hulud: Here We Go Again" supply-chain worm wave on August 4, 2026. A preinstall lifecycle hook was added that downloads a standalone Bun runtime and executes a heavily obfuscated ~728 KB Bun-CJS payload (math_init.js). This payload harvests credentials from GitHub, npm, cloud providers (AWS, GCP, Azure), HashiCorp Vault, Kubernetes, CI/CD secrets, and private keys, then uses stolen npm tokens to republish further packages with the same malicious hook. The attack uses an alternate-runtime dropper pattern to evade Node-based supply-chain scanners. The package's legitimate purpose does not require such a runtime, confirming malicious intent. The worm poisoned over 400 packages across multiple organizations in a short time window.
Potential Impact
Installation of affected versions results in execution of attacker-controlled code during npm install, leading to full compromise of the environment. The payload steals a broad range of credentials and secrets, including cloud keys and CI/CD tokens, enabling attackers to escalate access and propagate the worm further. Any system that installed these versions with install scripts enabled is considered compromised, with potential exposure of sensitive organizational secrets and infrastructure.
Mitigation Recommendations
No official patch or remediation is indicated in the provided data. The vendor advisory is not available, so patch status is not confirmed—check the vendor advisory for updates. Immediate actions include removing the affected package versions, rotating and revoking all credentials and secrets accessible from the compromised environment (npm tokens, GitHub tokens, cloud provider keys, Vault/Kubernetes secrets, CI/CD secrets), and treating any environment that installed these versions with install scripts enabled as fully compromised. Because the payload executes during install via an alternate runtime, standard Node.js supply-chain scanners may not detect it. Full system compromise means remediation may require rebuilding affected systems from clean sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-11757
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-g4r2-833j-2226"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a79f0f4bf8831d539f6471d
Added to database: 08/10/2026, 15:40:36 UTC
Last enriched: 08/10/2026, 16:11:32 UTC
Last updated: 08/10/2026, 17:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.