{"id":149530,"date":"2025-11-25T17:11:58","date_gmt":"2025-11-25T15:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov"},"modified":"2025-11-25T17:11:58","modified_gmt":"2025-11-25T15:11:59","slug":"pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/pri-pomoshhi-chervya-shai-hulud-skomprometirovano-600-npm-paketov","title":{"rendered":"600 NPM packages compromised using the Shai-Hulud worm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A second attack on packages in the NPM repository has been recorded, utilizing a modification of the self-replicating worm Shai-Hulud, which injects malware into dependencies. As a result of the attack, malicious releases of 605 packages have been published, totaling over 100 million downloads. <\/p>\n
To conduct the attack, the attackers intercepted the account parameters of the maintainer of one of the popular packages used as a dependency by a large number of packages through phishing. Taking advantage of the compromised account, the attackers published a package release that included code to activate the worm when the affected package was installed as a dependency. The activated worm searches for credentials in the current environment, downloading and running the TruffleHog utility. <\/p>\n
If an NPM directory connection token is discovered, the worm automatically publishes new malicious releases for packages being developed in the current environment. This way, the entire dependency tree is compromised. In addition to the NPM token, the worm saves access keys to GitHub and cloud services like AWS, Azure, and GCP (Google Cloud Platform), as well as environment variables and other sensitive data that the TruffleHog scanner can detect. <\/p>\n
Confidential data found in the system is uploaded to GitHub by creating repositories with random names (for example, «qzx15djl71alh6p80h») and the phrase «Sha1-Hulud: The Second Coming» in the description, as well as being encoded and logged in GitHub Actions logs. The created repository will contain a file in JSON format (for example, jsonactionsSecrets.json or contents.json), which has a line with base64-encoded information about the system, environment variables, and captured data. To transmit information externally from GitHub-based continuous integration systems, the worm creates a GitHub Actions handler named «.github\/workflows\/formatter_123456789.yml» and configures a runner named SHA1HULUD. <\/p>\n
The differences from a similar September attack come down to a different method of injecting malicious code into the package. The malicious releases generated by the worm claim to implement support for the JavaScript platform Bun. In the package.json file, the «preinstall» section, which defines scripts run before installation starts, adds the command «node setup_bun.js».
<\/center> <\/p>\n
The «setup_bun.js» file contains code to execute an obfuscated script «bun_environment.js», which includes the worm's code. For further distribution, the worm finds package code, modifies the package.json file (increases the version number and includes a call to setup_bun.js), adds the files setup_bun.js and bun_environment.js, repackages the package, and executes the «npm publish» command to upload the new release. <\/p>\n
![\"600](\"\/wp-content\/uploads\/2025\/11\/9b6fe1ba9d28fa5432b53d051ad21724.png\")
<\/center> <\/p>\n