More than 187 JavaScript code packages available through NPM have fallen victim to a self-propagating worm that harvests developer credentials and exposes them publicly on GitHub, according to security researchers. The malware briefly affected multiple packages from security vendor CrowdStrike and generates additional credential theft each time someone installs a compromised package.
The malware has been named Shai-Hulud, referencing the massive sandworms from Frank Herbert's Dune science fiction series, because it publishes stolen credentials in new public GitHub repositories bearing the name "Shai-Hulud."
"When a developer installs a compromised package, the malware will look for a npm token in the environment," explained Charlie Eriksen, researcher at Belgian security firm Aikido. "If it finds it, it will modify the 20 most popular packages that the npm token has access to, copying itself into the package, and publishing a new version."
NPM, which stands for Node Package Manager, functions as the primary distribution platform for JavaScript libraries and components used across development projects worldwide.
Recent NPM Compromise History
The Shai-Hulud outbreak arrived shortly after attackers executed a phishing campaign impersonating NPM, requesting developers update their multi-factor authentication credentials. That campaign resulted in malware being inserted into roughly two dozen NPM packages before being rapidly contained; however, that particular attack focused narrowly on cryptocurrency theft.
In late August, a separate NPM developer account compromise led to malicious code being injected into "nx," an open-source development toolkit downloaded approximately six million times weekly. The nx attack introduced code designed to locate authentication tokens from platforms including GitHub and NPM, along with SSH and API keys. Rather than transmitting stolen credentials to an attacker-controlled server, the malicious code created a public GitHub repository within the victim's account and published the stolen data there for unrestricted access.
Unlike the nx incident, Shai-Hulud operates as a self-replicating worm and incorporates reconnaissance capabilities to facilitate its distribution. The malware leverages TruffleHog, an open-source utility, to identify exposed credentials and access tokens on developer machines, then attempts to establish new GitHub actions and publish any stolen secrets.
Attack Mechanics and Spread
"Once the first person got compromised, there was no stopping it," Eriksen told KrebsOnSecurity. According to Eriksen, the initial NPM package altered by this worm was modified on September 14 at approximately 17:58 UTC.
Security platform socket.dev documented that Shai-Hulud briefly compromised at least 25 NPM packages maintained by CrowdStrike before the NPM registry swiftly removed them.
In a statement to KrebsOnSecurity, CrowdStrike confirmed detecting malicious packages in the public NPM registry, stating the company "swiftly removed them and rotated its keys in public registries." The company added: "These packages are not used in the Falcon sensor, the platform is not impacted and customers remain protected," referring to its endpoint threat detection service. "We are working with NPM and conducting a thorough investigation."
Analysis by StepSecurity revealed the malware enumerates secrets from AWS, Azure, and Google Cloud Platform for cloud-specific operations. The attack design specifically targets Linux and macOS environments while deliberately avoiding Windows systems.
StepSecurity noted that Shai-Hulud spreads by exploiting stolen NPM authentication tokens to inject its code into the 20 most-used packages associated with a victim's account.
"This creates a cascading effect where an infected package leads to compromised maintainer credentials, which in turn infects all other packages maintained by that user," wrote Ashish Kurmi of StepSecurity.
Eriksen indicated that Shai-Hulud continues spreading, though its propagation rate has declined recently. "I still see package versions popping up once in a while, but no new packages have been compromised in the last ~6 hours," Eriksen said. "But that could change now as the east coast starts working. I would think of this attack as a 'living' thing almost, like a virus. Because it can lay dormant for a while, and if just one person is suddenly infected by accident, they could restart the spread. Especially if there's a super-spreader attack."
The web infrastructure used by attackers to collect exfiltrated data appears to have been disabled due to rate limiting, according to Eriksen.
Calls for Structural Changes
Nicholas Weaver, researcher at the International Computer Science Institute in Berkeley, California, characterized the Shai-Hulud worm as "a supply chain attack that conducts a supply chain attack." Weaver argued that NPM and comparable package repositories must transition to a publication model requiring explicit human approval for each release using phishing-resistant two-factor authentication.
"Anything less means attacks like this are going to continue and become far more common, but switching to a 2FA method would effectively throttle these attacks before they can spread," Weaver stated. "Allowing purely automated processes to update the published packages is now a proven recipe for disaster."
Source: Krebs on Security