Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack

Reported 30 Apr 2026 by otx · Severity: medium

The intercom-client npm package version 7.0.4 was compromised through a malicious GitHub account, introducing credential-stealing malware into a widely used Node.js SDK with approximately 360,000 weekly downloads. The attack deployed two malicious files: setup.mjs, executed via p