# Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch

- **Severity:** Critical
- **Signature ID:** `76ec3096-29a5-46b5-8349-c619b5eb8630`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM03 (Supply Chain)

## Summary

A malicious npm/PyPI package installs a background daemon called gh-token-monitor that quietly checks your GitHub login every minute. If it ever sees the token get revoked, it deletes your entire home directory as a last act of sabotage.

## How the attack works

An attacker trojanizes npm packages (including @mistralai/mistralai, TanStack, and others) and PyPI packages (mistralai, guardrails-ai) so that installing or importing them runs hidden setup code. That code drops a persistence mechanism — a macOS LaunchAgent plist or a Linux systemd user service — named gh-token-monitor. The daemon polls api.github.com/user every 60 seconds to check whether its GitHub token still works. The moment the API returns 401 (token revoked, e.g. because a security team caught the compromise and rotated credentials), the daemon runs rm -rf against the user's home directory as a destructive dead-man's-switch, destroying data as retaliation for being cut off.

## Why it matters

Victims who install one of the ~403 trojanized package versions get a persistent backdoor plus a self-destruct trigger: revoking the stolen GitHub token — the normal incident-response move — causes total loss of the user's home directory, including source code, SSH keys, and local credentials.

## What you can do

- Search for and remove ~/Library/LaunchAgents/com.user.gh-token-monitor.plist (macOS) or ~/.config/systemd/user/gh-token-monitor.service (Linux) on any machine that installed affected packages.
- Before revoking a suspected-compromised GitHub token, back up the affected home directory and isolate the machine, since revocation is the trigger for the destructive payload.
- Audit installed npm and PyPI package versions against known-compromised releases of @mistralai/mistralai, TanStack, mistralai (PyPI), and guardrails-ai, and pin dependencies to vetted versions.
- Review install-time hooks (npm prepare/preinstall scripts, Python __init__.py side effects) in your dependency tree rather than trusting them to run silently.

## Known benign look-alikes

- GitHub API client libraries that poll /user for legitimate session validation without a destructive paired action.
- Documentation showing api.github.com/user usage examples without nearby rm/drop/exec patterns.
- Skill descriptions naming `gh-token` in unrelated context (e.g. `gh-token-helper`) — the regex requires the full `gh-token-monitor` or `gh_token_monitor` token.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00525

---
Source: https://www.netzilo.com/threats/atr-mini-shai-hulud-gh-token-monitor-persistence-dead-man-s-swit