Unit 42 Details Shai-Hulud npm Worm’s Credential Theft and Self-Propagation
Summary
Unit 42 analyzes a malicious @bitwarden/cli package attributed to a TeamPCP campaign. Its payload harvests developer and cloud credentials, exfiltrates them through C2 and GitHub, and backdoors npm packages to spread.
Key points
- The analyzed @bitwarden/[email protected] package uses a preinstall hook and a secondary command trigger to run its payload.
- The malware targets developer files, environment variables, GitHub Actions secrets, and secrets in AWS, Azure, and Google Cloud.
- It encrypts stolen data for HTTPS delivery to audit.checkmarx[.]cx and uses public GitHub repositories as a secondary exfiltration path.
- With stolen npm tokens, the worm modifies publishable packages to add a preinstall hook and republishes them, enabling further spread.
- The payload can inject a GitHub Actions workflow to collect repository secrets, then remove the branch and workflow run.
- Unit 42 recommends rotating exposed credentials, auditing packages and GitHub workflows, blocking listed indicators, and pinning dependencies.
Article Details
- Attack Vectors
- The malicious @bitwarden/[email protected] package runs a payload through its preinstall lifecycle hook; its bw_setup.js binary provides a second execution path when the bw command is invoked.
- The package downloads Bun v1.3.13 and uses it to run the obfuscated bw1.js payload.
- The payload harvests credentials and secrets from developer files, environment variables, GitHub CLI and Actions contexts, and accessible AWS, Azure, and Google Cloud secret stores.
- Using stolen npm tokens with publish permissions, the worm modifies and republishes packages with a preinstall hook that triggers further propagation.
- The malware exfiltrates encrypted data to an HTTPS C2 and to public GitHub repositories created under victims’ accounts.
- With GitHub tokens having repo and workflow scopes, the malware injects a workflow that collects repository secrets, retrieves the resulting artifact, and deletes the branch and workflow run.
- Defensive Notes
- Block the listed C2 domains and IP addresses at the network perimeter.
- Rotate potentially exposed npm tokens, GitHub PATs, cloud credentials, SSH keys, and CI/CD secrets.
- Audit maintained npm packages for unauthorized version changes and preinstall hooks; review GitHub for unexpected repositories, workflows, and artifact downloads.
- Hunt for unexpected Bun execution and outbound connections to the listed infrastructure.
- Pin dependencies with lockfiles and integrity hashes; use npm ci and consider disabling lifecycle scripts.
- Use a private registry or proxy, apply cooldown periods to newly published package versions, and restrict CI/CD egress to approved destinations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | audit[.]checkmarx[.]cx | C2 domain used for encrypted HTTPS credential exfiltration. |
| DOMAIN | checkmarx[.]cx | Domain identified in the article as attacker-controlled infrastructure. |
helloworm00@proton[.]me | Email address identified in the article as attacker contact information. | |
| IPV4 | 91[.]195[.]240[.]123 | IP address identified in the article as attacker infrastructure. |
| IPV4 | 94[.]154[.]172[.]43 | C2 IP address associated with the malware. |
| SHA1 | bc544f455d7c06c8a1f3446160a6d9a4a8236b11 | Dead-drop Git commit used by the malware to retrieve C2 configuration. |
| SHA256 | 167ce57ef59a32a6a0ef4137785828077879092d7f83ddbc1755d6e69116e0ad | Hash of the malicious package.json manifest. |
| SHA256 | 18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb | Hash of the malicious obfuscated bw1.js payload. |
| SHA256 | f35475829991b303c5efc2ee0f343dd38f8614e8b5e69db683923135f85cf60d | Hash of the malicious bw_setup.js bootstrap script. |
| URL | hxxps[:]//audit[.]checkmarx[.]cx/v1/telemetry | C2 endpoint receiving encrypted credential-exfiltration POSTs. |
| URL | hxxps[:]//github[.]com/helloworm00/hello-world | GitHub repository used as a dead-drop source for C2 configuration. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware read local files and included their contents in the exfiltration payload.T1027 · Obfuscated Files or InformationThe payload used string-table rotation, a seeded ASCII shuffle, compressed Base64 blobs, and mangled identifiers to obfuscate its code and data.T1041 · Exfiltration Over C2 ChannelThe malware sent encrypted harvested data to its C2 endpoint over HTTPS.T1078 · Valid AccountsThe malware stole and reused npm tokens and GitHub PATs to publish packages and access repositories.T1098 · Account ManipulationThe malware used compromised GitHub accounts to create repositories, branches, and workflow files, and used stolen npm tokens to publish packages.T1105 · Ingress Tool TransferThe bootstrap script downloaded Bun v1.3.13 during installation to execute the payload.T1195 · Supply Chain CompromiseThe campaign used a malicious npm package and backdoored legitimate packages to distribute the payload through the software supply chain.T1505 · Server Software ComponentThe article describes malicious workflow files and compromised developer-tooling distribution channels as means of embedding malicious components in CI/CD pathways.T1555 · Credentials from Password StoresThe payload read credential files and configuration stores from developer workstations.T1567 · Exfiltration Over Web ServiceUsing stolen GitHub tokens, the malware created public repositories and committed encrypted exfiltrated data.
Threat Actors
Malware
Vendors
Products
Bitwarden CLIThe package impersonates the legitimate Bitwarden CLI password manager.BunThe malware downloads a Bun runtime, runs a ~10 MB obfuscated payload (bw1.js), and uses multiple credential providers to harvest files, environment variables, and cloud secrets.Docker HubComponent – Embedded malicious components into developer tooling and CI/CD channels (GitHub Actions, Docker Hub images, VS Code extensions) to attain long-term distribution and pipeline persistence (’embeddingGitHub ActionsServer Software Component – Embedded malicious components into developer tooling and CI/CD channels (GitHub Actions, Docker Hub images, VS Code extensions) to attain long-term distribution and pipeline persistencenpmThe npm ecosystem shifted to a high-consequence threat landscape after the September 2025 Shai-Hulud worm enabled automated compromise and redistribution of malicious packages, accelerating token theft and CI/CDVS Codemalicious components into developer tooling and CI/CD channels (GitHub Actions, Docker Hub images, VS Code extensions) to attain long-term distribution and pipeline persistence (’embedding themselves into