Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Researchers at Aikido Security and Endor Labs are tracking a fast-spreading supply-chain attack that is compromising a wide range of npm software packages that combined have more than 2 billion installs a month and is stealing a wide range of secrets and other information. According to Ilyas Makari, malware researcher with Aikido, the bad actor on the morning of August 4, compromised the GitHub account of jaredwray, the maintainer behind keyv, a key-value storage library with about 127 million weekly npm downloads, and then used that access to spread information-stealing malware across the entire package family. “The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions,” Makari wrote in a report. Kiran Raj, security researcher and engineer with Endor Labs, wrote that “the pattern is consistent across them: an npm publishing token was stolen and used to push malicious versions, in most cases a CI or service-account token likely harvested from a build runner that had itself installed a poisoned dependency.” It appears to be an attack linked to Shai-Hulud, the notorious worm that rose to prominence late last year and has continued to haunt developers and the open source software packages they use. After stealing a range of credentials and other information from victims’ systems, the data is exfiltrated to a public GitHub repository whose description says “Shai-Hulud: Here We Go Again.” In his last update, …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.