A second attack on packages in the NPM repository has been recorded, utilizing a modification of the self-replicating worm Shai-Hulud, which injects malware into dependencies. As a result of the attack, malicious releases of 605 packages have been published, totaling over 100 million downloads.
To conduct the attack, the attackers intercepted the account parameters of the maintainer of one of the popular packages used as a dependency by a large number of packages through phishing. Taking advantage of the compromised account, the attackers published a package release that included code to activate the worm when the affected package was installed as a dependency. The activated worm searches for credentials in the current environment, downloading and running the TruffleHog utility.
If an NPM directory connection token is discovered, the worm automatically publishes new malicious releases for packages being developed in the current environment. This way, the entire dependency tree is compromised. In addition to the NPM token, the worm saves access keys to GitHub and cloud services like AWS, Azure, and GCP (Google Cloud Platform), as well as environment variables and other sensitive data that the TruffleHog scanner can detect.
The sensitive data found in the system is placed on GitHub by creating repositories with random names (for example, 'qzx15djl71alh6p80h') and the phrase 'Sha1-Hulud: The Second Coming' in the description, and is also output in encoded form to GitHub Actions logs. The created repository will contain a JSON file (for example, jsonactionsSecrets.json or contents.json), which includes a line with base64-encoded information about the system, environment variables, and captured data. To transfer information externally from GitHub-based continuous integration systems, the worm creates a GitHub Actions handler named '.github/workflows/formatter_123456789.yml' and configures a runner named SHA1HULUD.
The differences from a similar September attack lie in a different method of injecting malicious code into the package. The malicious releases created by the worm claim to implement support for the JavaScript platform Bun. The command 'node setup_bun.js' is added to the 'preinstall' section of the package.json file, which defines the scripts run before the installation begins.
The file "setup_bun.js" contains code to execute the obfuscated script "bun_environment.js," which includes worm code. For further distribution, the worm finds package code, modifies the package.json file (increases the version number and adds a call to setup_bun.js), adds the files setup_bun.js and bun_environment.js, repackages the package, and executes the command "npm publish" to release the new version.
Among the compromised popular packages are: @zapier/zapier-sdk (2.8 million downloads per week), @posthog/core (2.8 million), posthog-node (1.5 million), @asyncapi/specs (1.4 million), @postman/tunnel-agent (1.2 million). It is believed that the attack began with the compromise of the accompanying package @asyncapi/specs.
Source: opennet.ru
