Self-Replicating Worm Infects 180+ npm Packages in Automated Attack
▼ Summary
– A self-replicating worm called “Shai-hulud” is compromising npm packages and stealing credentials from developers who run infected packages.
– The worm uses stolen npm authentication tokens to infect additional packages and GitHub tokens to exfiltrate secrets to public repositories.
– It injects malicious code into packages that executes when downloaded, then spreads further by compromising new developer accounts and their packages.
– The attack shares similarities with the earlier “S1ngularity” campaign, including making private repositories public and targeting Linux/macOS developers.
– Over 187 packages have been confirmed compromised so far, with the first infection traced to rxnt-authentication package version 0.0.3 published on September 14th.
A significant software supply chain attack is currently spreading through the npm ecosystem, driven by a self-replicating worm that has already infected more than 180 packages. This automated threat, nicknamed “Shai-hulud,” steals developer credentials and uses them to propagate further, creating a dangerous cycle of infection that puts countless projects at risk.
The worm operates by compromising npm developer accounts and injecting malicious code into packages maintained by those users. When an unsuspecting developer installs one of these tainted packages, a post-install script triggers, executing a harmful JavaScript file. This allows the worm to harvest authentication tokens, which it then uses to compromise additional packages and accounts.
npm serves as the primary package manager for JavaScript, hosting millions of open-source libraries that form the backbone of modern web development. Since GitHub acquired npm in 2020, the platform has become deeply integrated with GitHub accounts and tokens, making stolen credentials especially valuable to attackers.
Once the worm gains access, it searches for sensitive data including GitHub personal access tokens, AWS keys, and npm authentication tokens. It uses a legitimate tool called TruffleHog to scan for these credentials. Valid tokens are then exploited to create public repositories under the victim’s account, where stolen secrets are uploaded in encoded form.
Additionally, the malicious script pushes new GitHub Actions workflows to every accessible repository, siphoning off secrets and sending them to an attacker-controlled URL. In a particularly invasive step, it also makes all private repositories public, appending “-migration” to their names and labeling them as part of the “Shai-Hulud Migration.”
Security researchers note that the infection appears to have started with the package `rxnt-authentication` on September 14th. From there, the worm has continued to spread autonomously, leveraging the publishing rights of compromised maintainers to infect new packages without manual intervention.
This incident shares alarming similarities with the earlier “S1ngularity” attack from August, which also targeted npm packages and exfiltrated data via GitHub repositories. Both attacks focused on developers using Linux or macOS systems, turned private repos public, and used stolen tokens to widen their reach.
The npm registry has faced several security challenges recently, including a separate incident where 18 popular packages were modified to include cryptocurrency-stealing code. The ongoing Shai-hulud campaign underscores the persistent threats facing open-source ecosystems and the critical need for robust security practices among developers.
(Source: HelpNet Security)
