OpenSourceMalware Show #20: Mini Shai-Hulud Payload Resurfaces on npm
Summary
The episode discusses four npm packages containing a Mini Shai-Hulud payload that resurfaced after 111 days, plus supply-chain threats, PolinRider’s execution method, GitHub defenses and developer precautions.
Key points
- Four packages published from one npm account within an hour on September 7 contained a static Mini Shai-Hulud payload linked to the May campaign against AntV.
- The payload went undetected for 111 days despite npm publish-time scanning; its command-and-control infrastructure was down, but the malware could still run locally.
- The hosts said the packages likely resurfaced through source-code cleanup or merging, and characterized the event as lingering malware rather than a new worm wave.
- PolinRider can use a VS Code tasks file to run a JavaScript payload when a repository is opened, regardless of the repository’s primary programming language.
- The hosts described inspecting VS Code task files, suspicious non-font font files, and obfuscated code in configuration files as useful checks for developers.
- The episode also discussed the limits of YARA rules against changing supply-chain malware and called for stronger detection and response by code-hosting and package platforms.
Article Details
- Attack Vectors
- Four npm packages published from the same account within one hour on September 7 contained the Mini Shai-Hulud payload previously associated with the May attack against AntV. The hosts attribute discovery to a matching malware hash.
- The hosts and the cited researcher suspect that old infected source code was inadvertently republished through development pipelines or branch merges; they do not describe the resurfacing as a new worm wave.
- PolinRider compromises repositories and force-pushes malicious commits while manipulating Git history to conceal changes from ordinary inspection in the GitHub web interface.
- Malicious VS Code task files automatically execute JavaScript payloads when a repository folder is opened, including in repositories primarily written in languages other than JavaScript.
- Payload delivery includes fake font files, poisoned configuration files, and malicious JavaScript placed in files such as app.js and database.js.
- The hosts describe malicious Baileys copycats used in Southeastern Asia to redirect WhatsApp payments to unintended recipients.
- Defensive Notes
- Inspect repository VS Code task configuration before opening unfamiliar projects, particularly tasks configured to run automatically on folder opening.
- Check for fake font payloads, including the source-mentioned fa-solid-900.woff2 filename, and inspect configuration and application files for obfuscated JavaScript.
- Do not assume a repository is safe because its primary programming language is not JavaScript; VS Code tasks can launch a separate JavaScript payload.
- The hosts recommend signed commits as an additional authenticity signal and caution that displayed Git commit identities and timestamps originate from locally supplied history.
- The hosts argue that registry and repository providers could scan proactively and retrospectively using known malware hashes and detection strings.
- YARA can contribute to detection, but the hosts caution that effective dependency inspection requires recursive coverage and that changing obfuscation and dynamically retrieved dependencies limit signature-only approaches.
- Although the resurfaced Mini Shai-Hulud C2 infrastructure was reportedly offline, the hosts emphasize that its malicious code could still execute locally.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe hosts report increasingly obfuscated JavaScript in poisoned configuration and other repository files, making recognizable signatures harder to extract.T1036.008 · Masquerade File TypeThe hosts describe malicious payloads disguised as font files, including fa-solid-900.woff2.T1059.007 · JavaScriptPolinRider places malicious JavaScript in repositories and executes it through VS Code task files, regardless of the repository's primary language.T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes poisoned npm dependencies and compromised source repositories distributing malware to developers through their development workflows.
People
CharlieResearcher at Aikido credited by the hosts with reporting four npm packages containing a hash-matched Mini Shai-Hulud payload.Jenn GileEpisode co-host who discusses the resurfaced npm payload, PolinRider repository compromises, and developer inspection guidance.Paul McCartyEpisode co-host who describes malicious repository hunting, Git history manipulation, and limitations of signature-based dependency inspection.
Threat Actors
Malware
ChainDropMini Shai-Hulud payload resurfaces on npm. A payload from May’s Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despitePolinRiderAI to close a skills gap, why GitHub allows git history to be rewritten and hasn’t done more to stop PolinRider, and what developers can realistically do to protect themselves, since PolinRider’s payload runs
Vendors
GitHubopen source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn’t done more to stop PolinRider, and what developers canMicrosoftand there are probably, in addition to like staffing reasons, there’s probably a lot of reasons that Microsoft has made the decision not to, um, be more restrictive on GitHub. I don’t personally know a lot aboutnpmMini Shai-Hulud payload resurfaces on npm. A payload from May’s Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despite
Products
Gitrarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn’t done more to stop PolinRider, and what developers can realistically doGitHubopen source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn’t done more to stop PolinRider, and what developers cannpmMini Shai-Hulud payload resurfaces on npm. A payload from May’s Mini Shai-Hulud campaign against AntV reappeared in four packages published within the same hour on September 7th, sitting undetected for 111 days despiteVS Codeif I were taking a look at a repo to fork or a package to download is I would look for the presence of a VS Code folder, uh, in the GitHub. And I would look for a task JSON file. That’s the first thing I would do. Um,
Tools
Countries
Cambodiathing for China. And then also too, unfortunately, some of those other countries in Southeastern Asia, Cambodia and Thailand, um, as I understand it, and may- and probably others, who knows?ChinaKorean, you know, DPRK, um, hackers in Russia. That’s, you know, pretty clear and, and same thing for China. And then also too, unfortunately, some of those other countries in Southeastern Asia, Cambodia andNorth Koreaon supply chain attacks, why malicious open source rarely targets specific countries, whether North Korea needs AI to close a skills gap, why GitHub allows git history to be rewritten and hasn’t done more toRussiaconference in Strasbourg, Jenn and Paul answer the questions they fielded all week: whether DPRK and Russia collaborate on supply chain attacks, why malicious open source rarely targets specific countries, whetherThailandAnd then also too, unfortunately, some of those other countries in Southeastern Asia, Cambodia and Thailand, um, as I understand it, and may- and probably others, who knows?
Industries
crypto[00:10:57] Paul McCarty: They are, they are generating income revenue by stealing crypto and other stuff. And so it doesn’t make a lot of sense for them to be collaborating with Russia, like the state or something,Web3Jenn Gile: So we tend to see a lot of that. Um, obviously we see a lot of that specific to crypto and Web3 because the overlap here is it’s usually financial motivation. Uh, we’re not seeing a lot of nation state