# PyTorch Lightning + intercom-client + intercom-php coordinated push

> Mini Shai-Hulud wave 2: coordinated April 30 release of `lightning` 2.6.2/2.6.3 (PyPI), `intercom-client` 7.0.4/7.0.5 (npm), and `intercom/intercom-php` 5.0.2 (Packagist) carrying the same Bun-based credential stealer used in the SAP/@cap-js wave. ~11.7MB `router_runtime.js` fires preinstall on npm; a `.pth` file fires at every Python import on PyPI. Worm propagation via stolen GitHub PATs labelled "OhNoWhatsGoingOnWithGitHub:".

- Published: 2026-04-30
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm, Packagist, PyPI
- Scope: 3 packages, 5 compromised versions
- Tags: worm, credential-theft, maintainer-takeover, ci-cd-compromise, obfuscation
- Also known as: Mini Shai-Hulud Wave 2
- Detected by: Socket, Wiz, Snyk, JFrog, Aikido
- Incident ID: multi-2026-04-30-mini-shai-hulud-wave2

## Affected packages (3)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [intercom-client](https://dependencywatch.io/package/npm/intercom-client) | npm | 7.0.4, 7.0.5 |
| [intercom/intercom-php](https://dependencywatch.io/package/packagist/intercom/intercom-php) | Packagist | 5.0.2 |
| [lightning](https://dependencywatch.io/package/pypi/lightning) | PyPI | 2.6.2, 2.6.3 |

## What happened

On 2026-04-30 the Mini Shai-Hulud crew (the same operators behind the SAP / `@cap-js` April 29 wave) staged a coordinated multi-ecosystem push: `lightning` `2.6.2` and `2.6.3` landed on PyPI, `intercom-client` `7.0.4` and `7.0.5` on npm, and `intercom/intercom-php` `5.0.2` on Packagist - all within a tight window and all carrying the same Bun-based credential stealer.

The npm side wires execution through a `preinstall` hook that pulls `router_runtime.js` - an ~11.7MB obfuscated bundle - and runs it under Bun. The PyPI side bypasses install hooks entirely: a `.pth` file dropped into `site-packages` re-executes the stealer on every Python interpreter start, so `pip install --no-build-isolation` and similar flags do NOT mitigate. The Packagist variant uses Composer plugin hooks fired on `composer install` and `composer update`.

The payload scrapes AWS, GCP, and Azure metadata endpoints at install/import time, harvests GitHub PATs, npm tokens, and SSH keys, and uses stolen tokens to publish further poisoned versions of any package the victim could push to - the classic worm propagation step. Compromised hosts also create signal repos on GitHub with the description `A Mini Shai-Hulud has Appeared`, and stolen tokens are catalogued under the label `OhNoWhatsGoingOnWithGitHub:`.

- npm IOC: `router_runtime.js`, `setup.mjs`, and `_runtime/` directories inside `node_modules`
- PyPI IOC: a `lightning.pth` (or similarly named) file dropped in `site-packages`
- Packagist IOC: unexpected Composer plugin hooks firing on install/update

Vendor coverage split the campaign across multiple posts: Wiz originally folded `lightning` into the TanStack analysis, but Socket, Snyk, JFrog, and Aikido independently confirmed it as a separate April 30 wave with its own publish timing distinct from the May 11 TanStack burst.

## Impact

- AWS/GCP/Azure cloud metadata harvesting at install/import time
- GitHub PAT, npm token, SSH key theft
- Self-propagation: stolen tokens used to publish poisoned versions of any package the victim could push to
- Composer plugin hooks on the Packagist side trigger on `composer install` / `update`

## What to do

1. Pin lightning ≤ 2.6.1 (PyPI), intercom-client ≤ 7.0.3 (npm), intercom/intercom-php ≤ 5.0.1 (Packagist)
2. Rotate GitHub PATs, npm tokens, cloud credentials, and SSH keys on any host that installed during the window
3. Search GitHub for repos created with description "A Mini Shai-Hulud has Appeared"
4. Hunt for `router_runtime.js`, `setup.mjs`, and `_runtime/` directories in node_modules and site-packages

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Intercom's npm package compromised in supply-chain attack](https://socket.dev/blog/intercom-s-npm-package-compromised-in-supply-chain-attack) - Socket
- [Mini Shai-Hulud: supply chain attack on SAP npm packages](https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm) - Wiz
- [Popular PyTorch Lightning package compromised by Mini Shai-Hulud](https://www.aikido.dev/blog/pytorch-lightning-pypi-compromise-mini-shai-hulud) - Aikido

---

Canonical page: https://dependencywatch.io/incident/multi-2026-04-30-mini-shai-hulud-wave2
Markdown version: https://dependencywatch.io/incident/multi-2026-04-30-mini-shai-hulud-wave2.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).