Researchers Spot New Shai Hulud Variant

Hackers behind the Shai Hulud malicious npm JavaScript campaign are likely testing a new variant of the malware.

See Also: Merging Without Mayhem: PAM Strategies that Work

Security researchers at Aikido on Sunday uncovered an apparently new Shai Hulud variant, uploaded to npm through a GitHub repository called @vietmoney/react-big-calendar. Shai Hulud is the moniker for a campaign of self-propagating attacks on the npm JavaScript repository by hackers who apparently took inspiration from the giant worms -necessary for spice production on the desert planet Arrakis in sci-fi series Dune. Attackers named GitHub repositories receiving stolen data “Shai Hulud,” after an in-universe term for the giant worms.

“There does not seem to be any major spread or infections,” Aikido researcher Charlie Eriksen said about the latest variant. “This suggests we may have caught the attackers testing their payload.”

Among the changes in the variant are modifications to the initial file, the main payload and improved error handling for TruffleHog, a secret scanner for tokens and cloud credentials.

Eriksen added there have been no packages or no new repositories linked to the malware strain since Dec. 10.

First identified in September, Shai Hulud infections began when developers downloaded malicious versions of popular JavaScript packages freighted with a script that harvested data and transmitted it to attackers’ GitHub repositories. The script allowed the attackers to harvest access tokens and automatically update packages with malicious code, allowing it to self-propagate (see: Shai Hulud Burrows Into NPM Repository).

Security firm Upwind in November uncovered another variant dubbed Shai Hulud 2.0. When developers downloaded the infected npm package, the worm hooked itself into npm at the pre-install stage, allowing attackers to automate infection. The campaign infected 1,000 new malicious repositories every 30 minutes, hitting more than 25,000 npm repositories (see: Breach Roundup: Shai-Hulud 2.0 Sparks Massive npm Supply Chain Breach).

Microsoft described the campaign as “one of the most significant cloud-native ecosystem compromises,” while security firm Wiz called the attacks one of the “most severe JavaScript supply-chain attacks.”