New Shai-Hulud worm spreading through npm, GitHub

"A new version of the Shai-Hulud credentials-stealing self-propagating worm is expanding through the open npm registry, a threat that developers who download packages from the repository have to deal with immediately. Researchers at Wiz Inc. said Monday that in the early stages of the campaign late last week,a thousand new GitHub repositories containing harvested victim data were being added every 30 minutes. And researchers at JFrog identified 181 compromised packages."

"The current campaign introduces a new variant, which Wiz researchers dub Shai-Hulud 2.0, that executes malicious code during the preinstall phase, "significantly increasing potential exposure in build and runtime environments." The threat leverages compromised package maintainer accounts to publish trojanized versions of legitimate npm packages. Once installed, the malware exfiltrates developer and CI/CD secrets to GitHub repositories, and also inserts the malicious payload into all of the users' available npm packages."

"JFrog said this new variant generates randomized repository names for exfiltration, making it harder for security teams to hunt down and scrub the leaked secrets. JFrog also said the new payload contains new functionality, including privilege escalation, DNS hijacking, and the ability to delete data from the victim's machine. Multiple popular packages used by developers, including those from Zapier, ENS Domains, PostHog, and Postman, have been compromised."

The Shai-Hulud worm is spreading through the open npm registry and has propagated rapidly, with thousands of GitHub repositories containing harvested victim data appearing within short timeframes. The latest variant executes malicious code during the preinstall phase, increasing exposure in build and runtime environments. Compromised maintainer accounts are used to publish trojanized packages that exfiltrate developer and CI/CD secrets to attacker-controlled GitHub repositories and inject the payload into users' available npm packages. The payload now generates randomized repository names for exfiltration and includes privilege escalation, DNS hijacking, and data-deletion capabilities. Multiple popular packages, including @asyncapi/specs, have been compromised.

Read at InfoWorld