More than 400 npm packages carry one worm
Microsoft Threat Intelligence says a supply chain attack pushed malicious releases of more than 400 npm packages from unrelated publishers, among them keyv, flat-cache and cache-manager. Each release carries a Mini Shai-Hulud variant. It is a credential-stealing worm, packed into a large, obfuscated Bun-based JavaScript payload that runs from an npm preinstall hook before installation finishes.
Microsoft says the evidence points to stolen maintainer credentials for the first compromise. Many malicious versions had no matching commit, pull request or tag. The attackers changed the tarballs and published them directly.
From a preinstall hook to republished packages
- On a developer workstation the payload detaches and keeps running after the install. In CI it stays in the job so it can reach workflow secrets, runner credentials and OIDC publishing permissions.
- It collects credentials from files, environment variables, command-line tools and GitHub Actions runner memory, then logs in to npm, GitHub, AWS, Kubernetes and HashiCorp Vault to list more resources and secrets.
- Stolen data is encrypted with AES-256-GCM, the key is wrapped with the attacker’s RSA key, and it is sent to an attacker-controlled HTTPS endpoint. Public GitHub repositories serve as the fallback.
- With an npm token it downloads each package the identity can publish, inserts itself, bumps the patch version and republishes. With GitHub access it writes Claude and VS Code configuration files into repository branches.
Pin versions, purge caches, rotate from a clean host
- Update to npm CLI v12 and use its
min-release-agesetting so brand-new releases are not installed right away. - Check dependency trees, lockfiles, artifact repositories and CI caches, including transitive references, and pin known-good versions.
- Purge npm and yarn caches on affected endpoints and build hosts.
- Rotate credentials from a clean host if a workstation or build system installed an affected version.
- Rebuild affected projects, shared base images and golden build runners from a known-good dependency baseline so future jobs do not inherit poisoned caches.
Hijacked workflows can still produce valid provenance
Microsoft also treats this as a release-process problem. A package published through a hijacked workflow can carry valid provenance. So software producers should review token scopes, workflow approvals, protected environments and alerts on automated package publishing.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Sources
Primary source:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
