40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials

Cybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages from multiple maintainers. The compromised versions inject a local bundle.js and modify package.json to trojanise downstream packages, enabling the attacker to search developer machines for secrets using TruffleHog and transmit them to an external server.

The campaign can target both Windows and Linux systems, with the injected code designed to download and run TruffleHog to scan for tokens such as GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. The affected packages include angulartics2@14.1.2, @ctrl/deluge@7.2.2, @ctrl/golang-template@1.4.3 and several others listed by The Hacker News.

The malicious script validates npm tokens via the whoami endpoint and can interact with GitHub APIs when a token is present, and it writes a GitHub Actions workflow in .github/workflows to exfiltrate data, a workflow that persists beyond the initial host according to Socket. Developers are advised to audit their environments and rotate npm tokens and other secrets if these packages with publishing credentials are present, according to Socket.