Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Socket AI scanner detected malicious intercom-client@7.0.4 npm package compromised as part of the ongoing Mini Shai-Hulud worm attack. The package contains malicious files setup.mjs and router_runtime.js that execute during installation via preinstall hooks. The attack downloads unverified Bun binaries and uses heavily obfuscated JavaScript to harvest Kubernetes, Vault, and cloud credentials from environment variables and local files. Stolen secrets are encrypted and exfiltrated through GitHub API. The compromise is linked to TeamPCP activity and affects roughly 360,000 weekly downloads with over 100 dependent projects. GitHub user nhur showed suspicious activity creating repositories with Dune-themed names and modifying CI workflows to exfiltrate repository secrets.