A new supply chain attack, dubbed Shai-Hulud, has compromised 868 npm packages, which collectively see over 2 billion downloads each month. The attack was identified by researchers at Aikido, who discovered that the GitHub account of the maintainer of the key-value storage library, keyv, was breached. Using this access, the attackers infected the entire package family with malware designed to harvest credentials and secrets from compromised machines.
The malicious software exploits a preinstall hook that activates during npm installations, downloading the Bun runtime silently and collecting credentials for npm, GitHub, AWS, and Vault. The attackers quickly pushed the compromised versions to the main branch and released them with signatures verified by GitHub Actions. The reach of this attack extends to high-profile organizations such as Deliveroo, OneReach, Picsart, and Qlik, indicating a significant community spread among developers and packages.
This incident underscores the critical importance of securing supply chains in software development, as the consequences of such breaches can be extensive. Developers and organizations using npm packages should review their dependencies and ensure that they are not using compromised versions. It's essential to stay informed about such vulnerabilities and act swiftly to mitigate their impact.