Mini Shai-Hulud gh-token-monitor Persistence + Dead Man's Switch - ATR-2026-00525 (1de92a2d-db45-5244-ba13-571f46edc243)
Detects the persistence and dead-man's-switch IOCs of the Mini Shai-Hulud npm/PyPI supply-chain worm (2026-05-11 wave, ~403 trojanized package versions across ~172 unique packages including @mistralai/mistralai and TanStack via npm prepare hook, plus mistralai + guardrails-ai PyPI via init.py on-import side-effect; UiPath sub-cluster used preinstall + node setup.mjs). The worm installs a gh-token-monitor daemon (real IOCs per Wiz: macOS plist ~/Library/LaunchAgents/com.user.gh-token-monitor.plist, Linux systemd user unit ~/.config/systemd/user/gh-token-monitor.service) that polls api.github.com/user every 60 seconds; on GitHub token revocation (HTTP 401) it runs rm -rf ~/ against the entire home directory. The detection target is the daemon name string and the token-revoke + destructive-action pairing — both of which are absent in legitimate skill/tool descriptions but characteristic of this campaign.