Known Shai-Hulud payload returns through four npm packages
A known Shai-Hulud software supply-chain payload resurfaced yesterday in four npm package releases published within an hour. Researchers found the files were a byte-for-byte match for malware used in an earlier compromise in May.
The return of an unchanged, previously documented file after 111 days without sightings is a reminder that registry scanning is no panacea for malware detection. Since July, npm employs an automated system to check packages for known malicious content and runs them to look for new patterns of possible malicious behavior. Every package gets held for up to 15 minutes while it gets analyzed.
The worm runs through an installation lifecycle hook. Earlier analysis of the same payload found capabilities to collect npm and GitHub tokens, cloud credentials, SSH keys, and CI/CD secrets; validate stolen publishing tokens; modify package archives; increment versions; and republish poisoned releases. It can also alter developer-tool configuration files, creating a possible execution path after the original dependency is removed.
People responsible for application security should verify the four package versions below against lockfiles, artifact repositories, and recent build logs:
Sources:
