Major NPM Supply-Chain Attack Hits ENS-Linked Libraries in Shai Hulud Breach

Summary: A significant supply-chain attack targeting JavaScript-based Node Package Manager (npm) has compromised code libraries associated with the Ethereum Name Service (ENS) and numerous other software packages. This breach, identified as “Shai-Hulud: The Second Coming,” has infected hundreds of packages with over 132 million monthly downloads.

Key Takeaways

A new malware attack named “Shai-Hulud: The Second Coming” has targeted npm packages related to ENS, affecting over 490 packages.
The malware can automatically collect sensitive information from developers’ environments, including passwords and API keys.
Previous versions of the attack were less sophisticated, highlighting a significant evolution in the threat landscape.
Experts warn developers to audit their systems and rotate their credentials if they used compromised packages.

Massive NPM Supply-Chain Attack Targets ENS-Linked Libraries in Shai Hulud Breach

Overview of the Shai-Hulud Supply-Chain Malware

In a significant revelation from Aikido Security, a large supply-chain malware attack has impacted numerous JavaScript-based npm packages linked to the Ethereum Name Service (ENS) and older software applications. The malware, known as “Shai-Hulud: The Second Coming,” has compromised hundreds of code libraries and affected over 25,000 GitHub repositories, according to malware researcher Charlie Eriksen.

The malware has infiltrated over 490 npm packages, collectively receiving more than 132 million downloads each month, including well-known packages from ENS, Zapier, AsyncAPI, Browserbase, and Postman.

“If a developer installs one of these compromised packages, the malware operates in the background during installation, even before the process completes,” Eriksen explained.

Mechanism of Shai-Hulud Malware

As outlined by Aikido Security, the Shai-Hulud malware accesses the developer's local machine or cloud environment once a vulnerable package is installed. It then utilizes an automated tool called TruffleHog to search for sensitive data such as passwords, API keys, cloud tokens, and credentials from GitHub or npm.

Any sensitive information it finds is uploaded to a public GitHub repository named “Shai-Hulud: The Second Coming.” If the stolen credentials include access to code repositories or package registries, attackers can exploit them to breach additional accounts, allowing the malware to spread even further.

Progression from Previous Attacks

The first Shai-Hulud breach happened in early September, recording the largest npm attack at that time, with hackers reportedly stealing $50 million in cryptocurrency. Following that attack, Ledger, a hardware wallet provider, reported that the Shai Hulud worm began self-replicating autonomously within a week.

However, the infiltration technique for this second wave shows significant advancements. The “Shai-Hulud: The Second Coming” first installs a script named setup_bun.js which then executes bun_environment.js, containing the malicious code.

Massive NPM Supply-Chain Attack Targets ENS-Linked Libraries in Shai Hulud Breach

This new malware generates repositories with randomly assigned names containing the stolen data, unlike its predecessor, which used hardcoded names. It can also compromise up to 100 npm packages, compared to just 20 in the earlier version.

Uncovering Vulnerabilities in NPM Packages

Charles Guillemet, the Chief Technology Officer at Ledger, has warned the community that this malware specifically targets API keys, Git credentials, and CI/CD secrets, quietly stealing extensive amounts of data.

“If you are using compromised packages, please review your credentials and secrets closely, as they may be compromised. Audit your infrastructure and change your credentials,” he advised.

He recommended that anyone lacking close CI monitoring should consider shutting down their systems for safety.

Florian Roth, Head of Research at Nextron Systems, highlighted that it’s becoming all too easy for malicious actors to inject malware into sensitive systems due to overlooked vulnerabilities in NPM packages.

Historically, the industry focused on combating malware at the operating system level, but this new type of threat penetrates software ecosystems that users trust regularly.

“NPM tokens, transitive dependencies, weak account security, and a lack of visibility have created an environment where a self-propagating worm can wreak havoc in the supply chain," he noted.

In his analysis, Roth concluded that the Shai Hulud breach serves as a stark reminder that the true vulnerability lies within package ecosystems that operate as execution surfaces.

“No one monitors these ecosystems or hardens them, allowing attackers to exploit them without requiring an elaborate plan,” he stated.

JP Richardson, CEO of Exodus, the first public company in the United States to tokenize stocks on the blockchain, has also raised concerns regarding Microsoft’s response to these threats.

In a post from November 24, Richardson questioned, “Why is Microsoft (the owner of npm) not acting swiftly to detect these attacks?” He suggested that any npm package that includes a pre-install or post-install script should issue warnings before packages are installed to protect users better.