Massive npm infection: the Shai-Hulud worm and patient zero

According to Securelist, the Shai-Hulud worm has infected over 500 npm packages in a supply-chain attack, with a notable impact on popular libraries such as the @ctrl/tinycolor package, which is downloaded by more than two million users each week. The malware spreads by injecting a malicious bundle.js into infected packages and adding a postinstall script to trigger it after installation, then republishes the modified packages to npm.

It also exfiltrates secrets by using TruffleHog, AWS and GCP modules, and creates a GitHub repository named “Shai-Hulud” to store collected data, including a data.json file. The campaign involved self-propagation through the victim’s npm maintainer ecosystem, with the worm targeting the 20 most downloaded packages for each victim and updating them to include the malicious payload.

CrowdStrike libraries are among the affected infected libraries, illustrating the breadth of the compromise across well-known dependencies. The researchers note that one infected package, ngx-bootstrap version 18.1.4, ran the malicious command as a preinstall, which they identify as a possible starting point for the spread.