More than 2,200 malicious versions of 440 packages were published to the NPM registry as part of a fresh Mini Shai-Hulud supply chain attack.
Dubbed ChainDrop, the campaign started with 11 malware carriers in the keyv and cacheable namespaces, after their maintainer’s GitHub account was compromised.
Combined, the infected packages have over 500 million weekly downloads. They are widely used across the ecosystem and their poisoning led to 433 additional packages being infected.
Similar to previous Mini Shai-Hulud attacks, the infected packages executed malicious code during installation, dropping an information stealer with self-propagation functionality.
On the infected machines, the malware targets all the secrets it can find, encrypts them, and then exfiltrates the data either to a dynamic HTTPS endpoint or to attacker-created public GitHub repositories that have the ‘Shai-Hulud: Here We Go Again’ description.
“Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for NPM, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values,” Microsoft explains.
Additionally, the malware uses the stolen NPM credentials to publish poisoned versions of every package it can reach on the infected machine, and leverages compromised GitHub credentials and GitHub Actions to infect more repositories for credential theft, JFrog says.
“After obtaining an NPM publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages. The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path,” Microsoft notes.
Because the malware republished many historical versions of the compromised packages, the total number of malicious package iterations observed on August 4 reached 2,212 in under four hours, StepSecurity says.
All infected package versions contained a preinstall dropper designed to download the legitimate Bun JavaScript runtime alongside 710 KB of obfuscated second-stage code representing the actual malware.
An evolved descendant of the Shai-Hulud 2.0 worm, the malware uses an Ethereum blockchain for command-and-control (C&C), a technique called EtherHiding.
The worm also installs a host-level dead-man’s switch: after achieving persistence on macOS and Linux, it polls the GitHub API using the victim’s stolen GitHub token every 60 seconds, and deletes its state and exits if the token stops working. It also self-clears after 24 hours, Socket notes.
NPM developers who installed any of the infected package versions should consider their machines compromised. They are advised to remove the malware, rebuild CI runners and build machines, revoke and rotate potentially compromised credentials, and audit their GitHub repositories for anomalous activity.
“Isolate affected systems. Preserve package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before cleanup. You will need them to bound the exposure window,” JFrog recommends.
Related: New GitHub, PyPI Policies Boost Supply Chain Security
Related: US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security
Related: Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains
Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack
