Self-Replicating Worm Hits 180+ Software Packages

A self-replicating worm has infected at least 187 code packages on the NPM repository, stealing credentials from developers and publishing those secrets to GitHub. The malware, dubbed Shai-Hulud after the Dune sandworms, creates new public GitHub repositories named Shai-Hulud to publish any stolen credentials.

When a compromised package is installed, the worm searches for a npm token in the environment and, if found, modifies the 20 most popular packages that token can access to copy itself into the package and release a new version. The first compromised package appears to have been altered on 14 September at around 17:58 UTC, and the outbreak has been described as a living, spreading threat that can lay dormant and re-emerge.

According to Aikido and other researchers, the attack also involves reconnaissance tools such as TruffleHog to locate exposed credentials and access tokens. CrowdStrike reported that several malicious packages were removed from the public NPM registry and keys rotated, with their Falcon sensor platform not impacted.