intercom-client v7.0.4 is compromised

[h0x0er]

for more info: https://app.stepsecurity.io/oss-security-feed/intercom-client?version=7.0.4

[plafleur]

It also looks like every non-default branch was also updated with malicious code

For example: 46f2c48#diff-7d76d7533653c23b753fc7ce638cf64bdb5e419927d276af836d3a03fdf1745a

[jadoonf]

For any devs landing here trying to figure out what to do — sharing what we observed at runtime when intercom-client@7.0.4 runs inside an actions runner. This is the same TeamPCP / Mini Shai-Hulud loader that hit @bitwarden/cli@2026.4.0 (April 22) and the SAP @cap-js packages (April 29).

The publish-side diff is one line. package.json for 7.0.4 vs clean 7.0.3 is identical except for one new key:

"preinstall": "node setup.mjs"

All other scripts, dependencies, and metadata are unchanged. Same publishing identity (GitHub Actions OIDC). The registry-side signal is just the new preinstall hook + the timing — static scanners that don't diff every release have nothing to flag.

What executes on npm install:

npm install intercom-client → sh → node → bun → sh → gcloud config config-helper
                                           └→ sh → az account get-access-token
                                           └→ pwsh → Az.Accounts

Multi-cloud credential probing, then router_runtime.js exfiltration to zero.masscan.cloud (we observed 11 flows alongside credential-file access).

Loader fingerprint matches the prior campaign:

• setup.mjs SHA256: 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34 (identical across SAP CAP packages)
• __decodeScrambled cipher seed 0x3039 (same as Bitwarden CLI cluster 3 payload)
• Russian-locale process.exit(0) guardrail

If you ran npm install intercom-client (or any transitive dependency that resolved to it) since 2026-04-30 14:41 UTC, treat the host as compromised:

1. Uninstall, clear npm cache, pin to 7.0.3 or earlier in your lockfile until Intercom ships a clean 7.0.5.
2. Rotate every secret in scope of any CI runner that touched it — GitHub tokens, npm tokens, AWS / GCP / Azure credentials, SSH keys, environment variables.
3. Search every GitHub org you control for repositories with the description "A Mini Shai-Hulud has Appeared" and for commits authored as claude@users.noreply.github.com in the last 24 hours.
4. Sweep for .vscode/tasks.json (with runOn: folderOpen) and .claude/settings.json (with a SessionStart hook) — IDE persistence vector new in this campaign; opening an infected repo in VS Code or Claude Code re-detonates.

Happy to share the full telemetry with the team or any affected org

[jadoonf]

here's the run profile for 7.0.4: https://app.garnet.ai/runs/25178182242?repo=jadoonf%2Fgarnet-incident-pipeline&job=install&profile=019ddf51-76f2-7838-a44e-fba8d05a2b8b