cyber.hendryadrian.com
Security News · cyberscoop.com

Mini Shai-Hulud Supply-Chain Attack Spreads to More Than 860 npm Packages

· Original article ↗

Summary

A self-replicating Mini Shai-Hulud variant reportedly spread from a compromised maintainer account to more than 860 npm packages, stealing credentials and other sensitive data. Researchers said TeamPCP attribution is not yet confirmed.

Key points

  • An attacker used a compromised GitHub maintainer account to inject malicious code into more than 440 npm packages in under four hours.
  • The worm began in keyv and spread to other packages, including cacheable, flat-cache and file-entry-cache.
  • More than 860 packages were affected, with over 2 billion combined monthly installs, according to researchers.
  • Researchers said the malware stole npm, GitHub, AWS and CI credentials, along with AI configuration files and cryptocurrency wallets.
  • Wiz reported no new malicious packages observed after the initial wave and said affected packages appeared in more than 46% of cloud environments.
  • Researchers observed a common payload and pattern across affected packages, but Wiz said there were not yet hard links confirming TeamPCP attribution.

Article Details

Event Type
npm software supply-chain attack using self-replicating malware distributed through compromised packages
Impact
More than 440 npm packages were compromised in under four hours, with the attack later affecting over 860 packages that had a combined total of more than 2 billion monthly installs. The malware stole npm, GitHub, AWS, and CI credentials, as well as AI-related configuration files and cryptocurrency wallets.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe attacker compromised a maintainer account and injected malicious code into npm packages, compromising the software supply chain.

People

Ilyas MakariMalware researcher at Aikido Security who reported that more than 860 packages were compromised.

Threat Actors

TeamPCPResearchers linked the attack's patterns to TeamPCP activity, and the malware was built on an open-source Mini Shai-Hulud repository that TeamPCP published. Wiz Research said it did not have hard links to confidently attribute this attack to TeamPCP.

Malware

ChainDropAn attacker compromised a GitHub maintainer account and used a self-replicating Mini Shai-Hulud variant to inject malicious code into more than 440 npm packages in under four hours, quickly expanding the blast radius to

Products

GitHubAn attacker compromised a GitHub maintainer account and used a self-replicating Mini Shai-Hulud variant to inject malicious code into more than 440 npm packages in under four hours, quickly expanding the blast radius tonpmaccount and used a self-replicating Mini Shai-Hulud variant to inject malicious code into more than 440 npm packages in under four hours, quickly expanding the blast radius to over 860 packages.

Countries

South Africaactor, which Google previously told CyberScoop it attributes to one core operator that was located in South Africa during at least some of the attacks, compromised and injected malicious code into more than 1,000

Related Articles