"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack

According to Unit 42, Palo Alto Networks is investigating an active and widespread software supply chain attack targeting the Node Package Manager (npm) ecosystem. A novel, self-replicating worm, tracked as "Shai-Hulud," is responsible for the compromise of over 180 software packages. The attack is described as highly scalable, with automated propagation that leverages maintainers’ publishing rights to spread malicious code across the registry.

Unit 42 also assesses with moderate confidence that an LLM was used to generate the malicious bash script, based on the presence of comments and emojis. The malware exfiltrates harvested credentials to an actor-controlled endpoint, creates a new public GitHub repository named "Shai-Hulud," and commits stolen secrets to it, exposing them publicly; using the stolen npm token, the malware then publishes compromised package versions.

Mitigations include credential rotation, dependency auditing with tools like npm audit, reviewing GitHub accounts for unrecognised public repositories, and enforcing MFA on critical platforms.