TeamPCP Releases Shai-Hulud Worm Source Code, Raising Supply-Chain Attack Concerns
Summary
TeamPCP released Shai-Hulud worm source code and usage instructions. Researchers report forks, code modifications and fresh attacks; analysis describes credential theft, data exfiltration and anti-signature measures. Experts advise hardening developer and CI systems.
Key points
- TeamPCP published the worm’s source code and deployment instructions in GitHub repositories; GitHub removed the repositories, but Datadog says multiple forks appeared.
- TeamPCP and BreachForums promoted a supply-chain challenge offering monetary rewards for attacks using Shai-Hulud, according to the article.
- Ox Security says threat actors have already modified the source code and used it in new attacks.
- Datadog’s analysis describes modules for collecting secrets and exfiltrating data, along with persistence and package-poisoning mechanisms.
- Datadog says each build uses a randomly generated passphrase, producing different binaries from identical source and complicating signature-based detection.
- Recommended defenses include rebuilding affected developer and CI systems, rotating exposed credentials, restricting OIDC publishing, reviewing GitHub Actions, and monitoring package installation behavior.
Article Details
- Event Type
- Release of the Shai-Hulud worm’s source code, accompanied by instructions and a reported contest encouraging supply-chain attacks.
- Impact
- The release and appearance of forks lower the barrier for copycat attacks. The source describes credential and secret harvesting, data staging and exfiltration, persistence, and GitHub repository and NPM package poisoning. Ox Security reports that threat actors have already modified the code and used it in new attacks; further variants and supply-chain compromises are anticipated.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article says staged data was exfiltrated to a predefined command-and-control server.T1195.002 · Compromise Software Supply ChainThe article describes Shai-Hulud attacks involving GitHub repository and NPM package poisoning, a software supply-chain compromise.T1567.001 · Exfiltration to Code RepositoryThe article says data was exfiltrated to GitHub repositories.
People
Ben RonalloBlack Duck principal cybersecurity engineer who warned that releasing the source code and the BreachForums contest could lead to more Shai-Hulud variants and increased supply-chain compromise activity.Jonathan StrossPathlock senior product manager who recommended measures organizations should take to reduce risk from continuing Shai-Hulud-fueled supply-chain attacks.
Threat Actors
Malware
Vendors
Black Duck“These two events together will bring about a period of innovation for Shai Hulud, likely spawning several variants of the malware,” said Black Duck principal cybersecurity engineer Ben Ronallo.DatadogWhile GitHub removed the repos, multiple forks also appeared, Datadog says.OX SecurityAccording to Ox Security, threat actors have already started to modify the source code and use it in fresh attacks.PathlockAs Pathlock senior product manager Jonathan Stross pointed out, organizations should also assume that supply chain attacks fueled by Shai-Hulud will continue to mutate.
Products
GitHubThe code was shared via GitHub repositories under several users and was accompanied by detailed instructions on how to use it.GitHub Actionsrestrict OIDC trusted publishing to tightly scoped workflows and protected branches, pin and review GitHub Actions, monitor package install behavior, and treat build pipelines as production-grade attack surfaces,”npmThe source code also allowed the researchers to take a closer look at the malware’s persistence mechanism and dead-man switch, as well as at its GitHub repository and NPM package poisoning mechanisms.