GHSA-54PG-9963-V8VG: Supply Chain Compromise and Credential Theft in intercom-client

Vulnerability ID: GHSA-54PG-9963-V8VG

CVSS Score: 9.6

Published: 2026-05-07

The intercom-client npm package was compromised in a supply chain attack when a malicious version (7.0.4) was published to the public registry. This version contained an obfuscated payload designed to steal multi-cloud credentials, SSH keys, and tokens, exfiltrating them via a GitHub repository dead-drop mechanism.

TL;DR

A malicious version (7.0.4) of the intercom-client npm package executes an obfuscated preinstall hook to harvest cloud metadata and local secrets.…