A GitHub Actions release process compromise in the TanStack project allowed attackers to publish 84 malicious versions across 42 NPM packages in the TanStack stack to the NPM repository. Some of the compromised packages had over 10 million downloads per week.
Access to the release publishing was obtained due to an incorrect configuration of pull_request_target "Pwn Request" in GitHub Actions (the mask settings led to pull_request_target being triggered for pull requests from external forks), cache poisoning of GitHub Actions via the fork, and the ability to extract the OIDC token from the memory of the running runner process (Runner.Worker) by reading the contents of /proc//mem.
NPM packages with malicious changes were published on May 11 from 22:20 to 22:26 (MSK), noticed after 20 minutes and blocked after an hour and a half. Two malicious versions were released for each affected NPM package, integrating code to activate the mini-shai-hulud worm, which searched for tokens and credentials in the current environment. When a connection token to the NPM directory was detected, the worm automatically published new malicious releases for the packages being developed in the current environment, compromising the dependency tree. More than 400 NPM packages using TanStack packages among dependencies were affected in this way.
The worm was embedded in the router_init.js file and activated when the infected package was manually installed by the developer or automatically in a continuous integration environment using the commands "npm install", "pnpm install", or "yarn install". After activation, the worm searched the system for NPM tokens (~/.npmrc), AWS, GCP, Azure, HashiCorp, and Kubernetes K8s, as well as SSH private keys. The collected data was sent to the attackers via the decentralized P2P messenger getsession.org.
The worm was designed to perform destructive actions in case the captured NPM token was revoked — a periodic script run was set up in the system at ~/.local/bin/gh-token-monitor.sh that checked the token's activity every 60 seconds by querying api.github.com/user and executed the command "rm -rf ~/" in case the token was revoked.
Forrás: opennet.ru
