Mini Shai-Hulud npm Attack: More Than 2,200 Components Impacted

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR A new wave of the Shai-Hulud malicious package campaign emerged on npm, with 2,225 software component versions impacted. The malware executes through a malicious preinstall hook, steals npm, GitHub, cloud, Kubernetes, Vault, CI/CD, and other credentials, then uses stolen publishing access to compromise additional packages. Organizations that installed an affected version should treat the environment as potentially compromised. Remove the malware and any persistence before revoking credentials, then rebuild from known-good components. On August 4, 2026, Shai-Hulud re-emerged in the keyv and cacheable ecosystems on npm, quickly expanding into packages controlled by other maintainers, including packages in the @servicetitan namespace. The affected releases use trusted packages to deliver credential-stealing malware and propagate into additional npm components. The package may be legitimate while the release is not. What Happened? Attackers published malicious versions of legitimate npm packages through a compromised GitHub maintainer account and additional publishing accounts reached using stolen credentials, including accounts with access to packages in the @servicetitan namespace. The affected releases contain a malicious preinstall hook that invokes setup.mjs. Where dependency lifecycle scripts are permitted, the loader downloads a standalone Bun runtime and executes an obfuscated second-stage payload identified as Math_Symbol.js or Math_Init.js. npm 12 blocks unapproved dependency install scripts by default, but the hook can still execute in earlier …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.sonatype.com/blog/mini-shai-hulud-npm-attack-more-than-2200-components-impacted
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.