The npm attack that turned provenance attestations into camouflage

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

⁠Security researchers this week disclosed an npm supply-chain attack affecting more than 400 packages, including projects connected to Keyv and Cacheable. The attackers used stolen developer credentials to publish malicious versions.

This incident appears to point to a trend in software security: Attackers are going after the developers and workflows already trusted to publish. 

Attackers are going after the developers and workflows already trusted to publish. 

Worm spreads through credentials

According to Microsoft Threat Intelligence, the malicious releases contained a variant of the Mini Shai-Hulud credential-stealing worm as they bypassed source repositories as they spread, and began with stolen maintainer credentials. Once inside, the worm searched developer machines and CI environments for any other credentials it could use.

When it found an active npm publishing token, it downloaded the latest version of every package the account could access, injected a malicious preinstall lifecycle hook, bumped the patch number and published the infected versions. Because npm runs preinstall hooks automatically before installation finishes, the malware could start running on developer workstations and CI runners before application tests or security checks began.

Because npm runs preinstall hooks automatically before installation finishes, the malware could start running on developer workstations and CI runners before application tests or security checks began.

Preinstall hooks enable silent execution

In CI environments, it stayed connected to the active job, where it …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://thenewstack.io/npm-supply-chain-worm-attack/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.