Wiz has released the results of an analysis on the activities of the Shai-Hulud 2 worm, during which malicious releases of over 800 packages were published in the NPM repository, totaling more than 100 million downloads. Upon installation of the affected package, the activated worm searches for confidential data, publishes new malicious releases (upon detecting a connection token to the NPM directory), and publicly exposes sensitive data found in the system by creating new repositories on GitHub.
Over 30,000 repositories on GitHub have been found containing data intercepted by the worm. About 70% of these repositories include a content.json file, 50% contain a truffleSecrets.json file, and 80% have an environment.json file, all containing access keys, confidential data, and environment variables discovered in the systems of developers who installed the malicious package with the worm. Additionally, around 400 actionsSecrets.json files with keys found in environments for executing GitHub Actions have been identified in these repositories.
The contents.json files contained over 500 unique credentials and tokens for connecting to GitHub. The truffleSecrets.json files contained confidential data collected by the TruffleHog utility running on the affected system, which gathers over 800 types of data, including access keys, encryption keys, passwords, and tokens used across various services, cloud environments, products, and databases. In total, more than 400,000 unique entries were identified in truffleSecrets.json, of which about 2.5% (~10,000) were verified.
It is believed that the publicly available confidential information may serve as a starting point for a new wave of attacks, as many of the data remain valid. For example, the investigation revealed that 60% of access tokens to NPM captured from compromised systems remain active.
The report also provides overall statistics based on the analysis of environment variables from affected systems. 23% of worm launches occurred on developers' computers, while 77% were in continuous integration system environments (60% GitHub Actions, 5% Jenkins, 5% GitLab CI, 3% AWS CodeBuild). Linux was used in 87% of the systems, 12% used macOS, and 1% used Windows. 76% of the launches occurred in containers, while 13% were in bare-metal systems.
60% of all infections occurred due to the installation of malicious releases of packages @postman/tunnel-agent-0.6.7 and @asyncapi/specs-6.8.3. In 99% of cases, the worm was activated by running the command 'node setup_bun.js', specified in package.json under the preinstall section (the remaining 1% likely consists of testing attempts).
Source: opennet.ru
