Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch
A malicious npm/PyPI package installs a background daemon called gh-token-monitor that quietly checks your GitHub login every minute. If it ever sees the token get revoked, it deletes your entire home directory as a last act of sabotage.
How the attack works
An attacker trojanizes npm packages (including @mistralai/mistralai, TanStack, and others) and PyPI packages (mistralai, guardrails-ai) so that installing or importing them runs hidden setup code. That code drops a persistence mechanism — a macOS LaunchAgent plist or a Linux systemd user service — named gh-token-monitor. The daemon polls api.github.com/user every 60 seconds to check whether its GitHub token still works. The moment the API returns 401 (token revoked, e.g. because a security team caught the compromise and rotated credentials), the daemon runs rm -rf against the user's home directory as a destructive dead-man's-switch, destroying data as retaliation for being cut off.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 76ec3096-29a5-46b5-8349-c619b5eb8630
- Severity
- Critical
Why it matters
Victims who install one of the ~403 trojanized package versions get a persistent backdoor plus a self-destruct trigger: revoking the stolen GitHub token — the normal incident-response move — causes total loss of the user's home directory, including source code, SSH keys, and local credentials.
What you can do
- →Search for and remove ~/Library/LaunchAgents/com.user.gh-token-monitor.plist (macOS) or ~/.config/systemd/user/gh-token-monitor.service (Linux) on any machine that installed affected packages.
- →Before revoking a suspected-compromised GitHub token, back up the affected home directory and isolate the machine, since revocation is the trigger for the destructive payload.
- →Audit installed npm and PyPI package versions against known-compromised releases of @mistralai/mistralai, TanStack, mistralai (PyPI), and guardrails-ai, and pin dependencies to vetted versions.
- →Review install-time hooks (npm prepare/preinstall scripts, Python __init__.py side effects) in your dependency tree rather than trusting them to run silently.
Known benign look-alikes
- GitHub API client libraries that poll /user for legitimate session validation without a destructive paired action.
- Documentation showing api.github.com/user usage examples without nearby rm/drop/exec patterns.
- Skill descriptions naming `gh-token` in unrelated context (e.g. `gh-token-helper`) — the regex requires the full `gh-token-monitor` or `gh_token_monitor` token.