New wave of widespread supply chain compromise impacting npm ecosystem

The NCSC is aware of reports of an evolved version of the Shai-Hulud worm circulating and compromising almost 500 packages.

This worm, similar to the previous variant, looks to harvest credentials from:

• GitHub,
• npm, and
• cloud platforms such as AWS, GCP, and Azure.

It then exfiltrates the stolen data to attacker-controlled GitHub repositories. It propagates by automatically infecting other packages owned by victims and, unlike the original worm, contains a destructive payload that triggers if the malware loses access to its infrastructure.

Some of the main differences between the current and previous attack are:

• It installs bun with the file setup_bun.js and then uses this to execute bun_environment.js which contains the malicious code,
• It creates a randomly named repository with stolen data, rather than a preset name, and
• If it can't authenticate to GitHub, create a repository on the platform, fetch a GitHub token, or find an npm token, then it will wipe all files in the user’s Home directory.