npm Supply Chain Attack Targets 187 Packages with Evolving Worm Tactics
The npm platform is currently under a significant security threat, with cybercriminals compromising at least 187 packages—and the number is still rising. This ongoing supply chain attack shares similarities with previous campaigns, notably the one targeting Nx at the end of August, where attackers posted developer secrets like credentials on public GitHub repositories.
Recent Developments and Attack Methodology
First identified by Socket and Step Security on September 15, the latest campaign initially affected 40 packages. However, malware researcher Charlie Eriksen from Aikido reports that an additional 147 packages have been compromised using similar techniques, including some from cybersecurity powerhouse CrowdStrike.
Eriksen warns that the attackers have "upped their game," evolving their approach to develop a self-propagating worm that can spread across projects without direct intervention.
How the Malware Operates
The malicious payload is embedded into widely-used npm packages. When a victim installs a compromised package, the code executes on their system to steal secrets, credentials, and system information. Key features of this attack include:
- Secret Scanning: The malware runs TruffleHog, targeting AWS keys, GCP and Azure credentials, GitHub tokens, cloud metadata endpoints, and npm authentication tokens.
- Exfiltration & Persistence: After collecting secrets, it creates a new repository named Shai-Hulud on the victim’s GitHub account—an homage to the worm in the Dune series—where stolen credentials and tokens are uploaded. It also encrypts a backup within GitHub Actions logs to ensure persistence.
- Self-Propagation: The malware uses valid npm tokens found on the victim’s machine to update other packages they control, spreading the malicious code further and infiltrating other private repositories.
Notable Packages and Responses
Among affected packages are those associated with CrowdStrike; the most prominent publicly visible package as of Monday was `@ctrl/tinycolor`, with approximately 2.2 million weekly downloads.
CrowdStrike responded swiftly, removing malicious packages and rotating their keys, confirming that their Falcon platform remains unaffected and customers are protected. They emphasized ongoing collaboration with npm and thorough investigations.
Recommendations for Developers and Maintainers
- Uninstall compromised packages: Remove any affected versions from your projects.
- Pin safe versions: Lock dependencies to known secure releases.
- Rotate secrets: Change credentials and tokens immediately.
- Monitor logs: Watch for unusual activity that may indicate infection.
This attack exposes the growing sophistication of supply chain malware, emphasizing the importance of vigilant security practices in open-source ecosystems.
---
Sources & Further Reading:
- Ongoing npm campaigns and advisories
- Developer security best practices
- Cybersecurity updates from CrowdStrike