Mini Shai-Hulud Worm Spreads Through Compromised NPM Packages

A massive supply chain attack has compromised over 400 npm packages, including those associated with major enterprise software ecosystems. The malware, dubbed Mini Shai-Hulud, is a self-propagating credential-stealing worm that uses a large, heavily obfuscated Bun-based JavaScript payload to infect developer workstations and continuous integration and delivery (CI/CD) environments.

The attackers used stolen maintainer credentials to gain initial access to the publishers' accounts. Once inside, they modified and published package tarballs directly, adding preinstall lifecycle scripts that launched the malicious file setup.mjs. This script then executed the payload, allowing it to search for credentials on the local system, shell, and GitHub Actions runner.

The malware uses recovered identities to authenticate to various services, including npm, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault. It then collects data, encrypts it, and transmits it through an attacker-controlled HTTPS endpoint or a fallback exfiltration channel using GitHub repositories.

One of the malware's most significant capabilities is its ability to propagate automatically. After obtaining an npm publishing token, it can enumerate packages available to the compromised identity, download their latest tarballs, insert the malware and setup loader, add a preinstall hook, increment the patch version, and republish the modified packages.