In a significant cybersecurity breach, more than 2,200 malicious versions of 440 packages were uploaded to the NPM registry as part of the latest supply chain attack named ChainDrop. This attack, associated with the Mini Shai-Hulud series, began by compromising 11 packages within the keyv and cacheable namespaces.
Widespread Impact Across the Ecosystem
The infected packages, which collectively receive over 500 million weekly downloads, play a crucial role in the software ecosystem. The contamination extended to 433 additional packages, amplifying the attack’s reach. Similar to earlier Mini Shai-Hulud incidents, the compromised packages executed harmful code upon installation, effectively deploying an information stealer with the capability to propagate itself further.
Once infiltrated, the malware aggressively searches for sensitive data on affected machines. It targets credentials and secrets, encrypting them and sending the data to either dynamic HTTPS endpoints or attacker-operated GitHub repositories labeled ‘Shai-Hulud: Here We Go Again.’
Technical Breakdown and Attack Methodology
According to Microsoft, the malware’s operation involves scanning developer environments, including CI/CD systems, to extract credentials for platforms like NPM, GitHub, AWS, Kubernetes, and HashiCorp Vault. These credentials allow the malware to access and manipulate packages, repositories, and cloud configurations.
The stolen NPM credentials are further utilized to republish tainted versions of packages. Additionally, compromised GitHub credentials enable the malware to alter repositories using GitHub Actions, facilitating further credential theft. JFrog reports that the malware also injects configuration files into repositories to maintain persistence and spread the infection among developers.
Advanced Techniques and Mitigation Strategies
The attack, an evolution of the Shai-Hulud 2.0 worm, employs Ethereum blockchain for command-and-control operations, a method termed EtherHiding. It also implements a dead-man’s switch on macOS and Linux systems, which checks GitHub API responses every minute and self-destructs if the token is invalid.
Developers utilizing the affected packages must consider their systems compromised. It is essential to remove the malware, rebuild CI/CD environments, and rotate credentials. Auditing GitHub repositories for unusual activities is also recommended. JFrog advises isolating impacted systems and preserving logs and package tarballs to assess the extent of the breach.
This incident underscores the importance of robust supply chain security measures for software developers and organizations relying heavily on open-source packages.
