{
  "title": "intercom-client npm Mini Shai-Hulud Compromise",
  "summary": "Intercom says an attacker published `intercom-client@7.0.4` on April 30, 2026 using credentials from a compromised developer account. The package executed a Bun-launched credential stealer during installation and was removed within hours.",
  "date": "2026-04-30",
  "severity": "critical",
  "tags": [
    "npm",
    "package-compromise",
    "supply-chain",
    "credential-theft",
    "shai-hulud"
  ],
  "sources_count": 5,
  "indicators": {
    "slug": "intercom-client-npm-shai-hulud",
    "since": "2026-04-30T14:41:04Z",
    "until": "unknown",
    "ecosystem": "",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [
      "setup.mjs",
      "api.github.com",
      "metadata.google.internal",
      "github.com"
    ],
    "urls": [
      "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/"
    ],
    "ips": [
      "169.254.169.254"
    ],
    "hashes": [
      "5f748fbc89cde66abefa826439c765a0081a027792e9da8d80fbf23571311622",
      "fe64699649591948d6f960705caac86fe99600bf76e3eae29b4517705a58f0e2",
      "5ae8b2343e97cc3b2c945ec34318b63f27fa2db1e3d8fbaa78c298aa63db52ed"
    ],
    "processPatterns": [],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}