MalwarePublished 4 Aug 2026Updated 18 Aug 2026

@ornikar/intl-config (npm) · Malicious Code

Affects @ornikar/intl-configSource GCVE Database

Malicious package : remove @ornikar/intl-config and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11757

What to do

Remove @ornikar/intl-config from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@ornikar/intl-config	Affected 10.0.2 – 10.0.10 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @ornikar/intl-config versions 10.0.2 through 10.0.10 were compromised as part of a large-scale npm supply-chain worm campaign in August 2026. The malicious versions include a preinstall hook that downloads and executes an obfuscated Bun runtime payload which steals a wide range of credentials and secrets from the infected environment. This payload propagates by republishing other packages accessible via stolen npm tokens, causing widespread contamination. Any environment that installed these versions with install scripts enabled should be considered fully compromised, requiring immediate credential rotation and removal of the package.

Impact

Installation of affected versions results in execution of attacker-controlled code during npm install, leading to full compromise of the environment. The payload steals a broad range of credentials and secrets, including cloud keys and CI/CD tokens, enabling attackers to escalate access and propagate the worm further. Any system that installed these versions with install scripts enabled is considered compromised, with potential exposure of sensitive organizational secrets and infrastructure.

Defensive guidance

Immediate actions include removing the affected package versions, rotating and revoking all credentials and secrets accessible from the compromised environment (npm tokens, GitHub tokens, cloud provider keys, Vault/Kubernetes secrets, CI/CD secrets), and treating any environment that installed these versions with install scripts enabled as fully compromised. Because the payload executes during install via an alternate runtime, standard Node.js supply-chain scanners may not detect it. Full system compromise means remediation may require rebuilding affected systems from clean sources.

Summary

The @ornikar/intl-config npm package was trojanized during the "Shai-Hulud: Here We Go Again" supply-chain worm wave on August 4, 2026. A preinstall lifecycle hook was added that downloads a standalone Bun runtime and executes a heavily obfuscated ~728 KB Bun-CJS payload (math_init.js). This payload harvests credentials from GitHub, npm, cloud providers (AWS, GCP, Azure), HashiCorp Vault, Kubernetes, CI/CD secrets, and private keys, then uses stolen npm tokens to republish further packages with the same malicious hook. The attack uses an alternate-runtime dropper pattern to evade Node-based supply-chain scanners. The package's legitimate purpose does not require such a runtime, confirming malicious intent. The worm poisoned over 400 packages across multiple organizations in a short time window.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 16:11 UTC

Technical details

References

Community reviews