The @ornikar/react-native-svg-transformer npm package was trojanized during the 'Shai-Hulud: Here We Go Again' npm worm campaign on August 4, 2026. The compromised versions (1.0.6 to 1.0.13) include a preinstall hook that runs a setup script downloading the Bun runtime and executing a heavily obfuscated ~728 KB Bun-compiled JavaScript payload. This payload steals a wide range of credentials including GitHub, npm, AWS, GCP, Azure, HashiCorp Vault, Kubernetes secrets, and CI/CD tokens. It also enumerates packages accessible by stolen tokens and republishes them with the same malicious hook, enabling rapid self-propagation. The malware exfiltrates stolen data to attacker-controlled GitHub repositories and over DNS. The trojanized package mimics the legitimate package's functionality but adds this malicious chain during installation.

Installing any affected version with install scripts enabled results in execution of a credential-stealing payload that compromises the host environment. The attacker gains access to a broad set of secrets and tokens, potentially leading to full environment compromise, unauthorized access to cloud and CI/CD infrastructure, and further supply-chain poisoning. The infection spreads by republishing other packages controlled by stolen tokens, amplifying the attack's reach. Systems with this package installed should be treated as fully compromised.

There is no official patch or fix available for this supply-chain compromise. The vendor does not provide remediation as this is a malicious republishing event. Immediate actions include removing the affected package versions (1.0.6 through 1.0.13) from all environments, rotating and revoking all credentials and tokens accessible from the compromised systems (including npm, GitHub, cloud provider keys, Vault, Kubernetes, and CI/CD secrets), and treating any environment that installed these versions with install scripts enabled as fully compromised. Credential rotation must be performed from a clean, uncompromised environment. Monitor for any signs of further compromise or unauthorized package publishing.