Shai Hulud Burrows Into npm Repository

An apparent “Dune” aficionado is responsible for the first self-propagating attack on the npm JavaScript repository in what one security company has called one of the most severe JavaScript supply-chain attacks so far.

See Also: Merging Without Mayhem: PAM Strategies that Work

A threat actor on Monday uploaded malicious versions of popular JavaScript packages to the npm repository. The packages contained a script that harvested data and transmitted it to GitHub repositories named “Shai-Hulud.” That’s a name for the giant worms necessary for spice production on the desert planet Arrakis in sci-fi series Dune.

Hackers first infected popular open-source color library @ctrl/tinycolor, which has more than two million weekly downloads, found Socket. The malware propagates itself by identifying access tokens to the npm repository and automatically updating packages with malicious code, said security firm Wiz. “As the first successful self-propagating attack in the npm ecosystem, this appears to be one of the most severe JavaScript supply-chain attacks observed to date,” the company wrote.

The nearly 500 impacted packages include multiple packages published by security vendor CrowdStrike. The malware steals data including GitHub tokens, Amazon Web Services tokens and npm credentials.

Affected packages were quickly removed by the npm registry, but security risks persists, said Charlie Eriksen, security researcher at Aikido Security, who has been tracking the campaign closely.

“Because the malware is self-replicating, the campaign is ongoing and could continue to affect additional packages and organizations for days or even weeks. Even with remediation steps, the persistence of this worm means the broader ecosystem remains at risk,” Eriksen told Information Security Media Group.

Aikido believes the threat actor behind the Shai-Hulud attacks in August launched a separate npm campaign targeting Nx packages that support the Nx open-source build platform for managing code bases. Like the Shai-Hulud attacks, the Nx hackers created a new public repository in victims GitHub account where they housed stolen secrets.

When a developer downloads any of the Shai-Hulud infected packages, malicious code replaces the package’s bundle.js file with its own version. The script downloads and executes TruffleHog, a secret scanner for tokens and cloud credentials to identify variables such as GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, Socket said.

Developers could accidentally pull in infected packages due to an infected package’s ubiquity, warned James Griffiths, founder and technical director of security firm CSA Cyber.

The campaign is the latest example of how hackers are exploiting “chain of trust” in open-source environments to carry out supply chain hacks, Griffiths added.

“Rather than manually pushing malicious versions, they are building tools that travel through trust relationships in package ecosystems,” Griffiths said. “Developers and organizations will need to budget for supply chain risk as a first-class concern, just as they would for vulnerability scanning, patching and infrastructure security.”