Skip to main content

Blog post · April 30, 2026 · netskope.com

Intercom [email protected] describes credentials harvesting via preinstall payload

Summary

The Intercom TypeScript Library [email protected] was published with malicious preinstall behavior that downloads a Bun runtime and runs payload code to harvest GitHub credentials, then uses those credentials to infect other npm packages. For enterprise IT and security teams, this adds another high-download npm target for credential containment and incident triage.

Research Overview

The report describes [email protected] as compromised through a drop-and-execute install flow that leads to GitHub credential theft. It characterizes the follow-on behavior as worm-like, using stolen credentials to reach additional packages.

The analysis links the observed behavior to earlier Shai-Hulud-style npm supply-chain compromises, which also used stolen credentials to spread. The report notes that [email protected] has high weekly download volume, contributing to the concern about future infected releases.

Key Findings

During installation, the package runs a setup.mjs script via a preinstall hook. The script downloads the Bun runtime from GitHub and then executes a payload identified as router_runtime.js.

The payload uses a GitHub auth token to harvest GitHub credentials, queries zero.masscan.cloud, and retrieves command-and-control instructions using GitHub’s public commit search API as a resolver. The report says the Bun binary self-deletes after execution to reduce forensic traces.

Technical Breakdown

The payload queries GitHub commit data from a specified repository, using search strings embedded in public commit messages. It references the repository https://github.com/LuisDepo/sayyadina-heighliner-138 and targets commits containing the strings “beautifulcastle” and “EveryBoiWeBuildIsAWormyBoi”.

After credentials are obtained, the report describes the attacker using them to infect additional npm pages. It also points to a prior outcome of this attack style, stating that in November 2026 it compromised more than 1,000 packages.

Blog Signals brief is a fact-based summary of the vendor blog.

Our summary. The original keeps its own byline.

Read the original on netskope.com

Companies in this article

Topics

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "legalName": "Wiretap Labs, LLC",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/intercom-intercom-client7.0.4-describes-credentials-harvesting-via-preinstall-payload/",
        "name": "Intercom [email protected] describes credentials harvesting via preinstall payload",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/intercom-intercom-client7.0.4-describes-credentials-harvesting-via-preinstall-payload/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "Intercom"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "EVP / SVP / VP / AVP"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Laggards"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Accelerated Attention"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
      "@type": "Person",
      "name": "Decision Insights Coverage",
      "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
    },
    "dateModified": "2026-08-23T12:29:40-06:00",
    "datePublished": "2026-04-30T15:06:26-06:00",
    "description": "Intercom [email protected] was compromised with a preinstall flow that downloads Bun, harvests GitHub credentials, and uses a GitHub commit search resolver.",
    "headline": "Intercom [email protected] describes credentials harvesting via preinstall payload",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Gianpietro Cutolo"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/netskope/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
        "name": "Netskope"
      },
      "url": "https://www.netskope.com/blog/shai-hulud-intercom-client-7-0-4"
    },
    "keywords": [
      "script"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/intercom-intercom-client7.0.4-describes-credentials-harvesting-via-preinstall-payload/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      },
      {
        "@id": "https://decisioninsights.ai/projects/bun/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/bun/",
        "name": "Bun"
      },
      {
        "@id": "https://decisioninsights.ai/projects/typescript/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/typescript/",
        "name": "TypeScript"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
    "@type": "Person",
    "description": "Blog posts, podcasts, and video analysis from across the industry, condensed into short, sourced summaries. Produced under our Standards & Methodology.",
    "name": "Decision Insights Coverage",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
  }
]

Is this your company? Get structured data for your own pages