The Node Package Manager (npm) ecosystem is again under attack, with over 600 packages compromised in a recent Shai-Hulud malware campaign. This attack highlights the ongoing risks of supply chain vulnerabilities and the increasing sophistication of attackers targeting developer tools.
What Happened
According to BleepingComputer, threat actors injected malicious code into 639 versions of 323 unique npm packages, with a strong focus on packages within the @antv ecosystem (charting, visualization, and related libraries). However, popular packages outside of @antv were also affected, including timeago.js, size-sensor, and jest-canvas-mock. This latest campaign, like previous Shai-Hulud attacks, focuses on stealing sensitive credentials – specifically, GitHub, npm, cloud, Kubernetes, Vault, Docker, database, and SSH credentials – from developer workstations and CI/CD environments. Data is exfiltrated using the Session P2P network, and, when possible, by creating repositories under compromised GitHub accounts. A concerning new development is the malware’s ability to generate valid Sigstore provenance attestations by abusing compromised CI environment OIDC tokens, allowing malicious packages to pass standard verification checks. The attackers are also exploiting stolen npm tokens to re-publish infected packages with incremented version numbers, facilitating self-propagation.
Socket reports that they have identified over 1,900 publicly visible GitHub repositories associated with this campaign, while Aikido reports over 2,700. The Shai-Hulud malware's code was recently leaked by the TeamPCP group, complicating attribution efforts.
Shai-Hulud-generated GitHub repositories: image omitted due to site embedding policy; open the original article (BleepingComputer) (opens in a new tab) to view it. Photo/source: BleepingComputer (https://www.bleepingcomputer.com/news/security/new-shai-hulud-malware-wave-compromises-600-npm-packages/ (opens in a new tab))
Why It Matters
This attack demonstrates the continued and increasing threat to the software supply chain. The compromise of hundreds of packages in a short time frame underscores the difficulty of maintaining package integrity. The ability to generate valid Sigstore provenance is particularly alarming, as it bypasses a key security measure intended to ensure package authenticity. The focus on CI/CD environments is also significant; compromised CI/CD systems provide attackers with a foothold to potentially compromise downstream projects and infrastructure. The fact that some of the compromised packages had been dormant for years suggests that infrequently updated packages are particularly vulnerable targets, as they are less likely to have robust security measures in place. For developers, this means increased vigilance is needed when adding dependencies. Enterprises relying on these packages, especially within CI/CD pipelines, need to investigate potential exposure and review access controls.
What To Watch
It is currently unclear how widespread the impact of this attack is, and further investigation is needed to identify all affected packages and systems. Developers should review their dependencies for compromised packages (Socket maintains a list of affected artifacts). Monitoring GitHub for unusual repository creation activity associated with your organization is also recommended. The effectiveness of Sigstore provenance is now under question, and the industry will likely need to evaluate and potentially enhance its mechanisms. It remains to be seen how the leak of the Shai-Hulud code will affect future attacks and attribution efforts. The continued evolution of this malware family warrants close monitoring by security teams.