Poisoned Pipeline / Incidents / AS155

AS155 · 2026-04

Intercom npm and Packagist Mini Shai-Hulud

npmPackagist / Composer

Socket: Intercom’s npm package compromised in Mini Shai-Hulud, then
a malicious Intercom PHP package on Packagist followed.

Mapped techniques

• T0121 Compromised legitimate artifact
• T0169 Push implants across repositories

supply-chain campaign

Sources

• https://socket.dev/blog/intercom-s-npm-package-compromised-in-supply-chain-attack
• https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise