New Shai-Hulud Campaign Compromises Hundreds of npm and PyPI Packages

Hundreds of packages on npm and PyPI have been compromised in a new supply-chain campaign called Shai-Hulud, which delivers credential-stealing malware targeting developers. The attacker hijacked valid OpenID Connect (OIDC) tokens to publish malicious package versions with verifiable provenance attestation (SLSA Build Level 3).

The attack, attributed to the threat group TeamPCP, began with the compromise of dozens of TanStack and Mistral AI packages but quickly spread to other popular projects like Guardrails AI, UiPath, and OpenSearch. The Shai-Hulud campaign emerged last September and has had several iterations, some of which exposed hundreds of thousands of developer secrets in automatically generated GitHub repositories.

The latest wave of attacks occurred yesterday, with the threat actor publishing numerous malicious packages in the TanStack namespaces on Node Package Manager (npm), then spreading to other projects using stolen CI/CD credentials.

Details of the Attack

The application security firm StepSecurity detected that the threat actor published the infected packages via the legitimate CI/CD pipeline, carrying with it valid SLSA provenance attestations issued by npm's signing infrastructure.

Endor Labs reported that the campaign affected 187 npm packages, with the malware self-propagating to other projects by exploiting compromised credentials.

The attackers used a combination of techniques, including dependency confusion and typosquatting, to distribute the malicious packages.

Impact and Trends of the Shai-Hulud Campaign

The Shai-Hulud campaign represents an alarming example of how software supply chain attacks are evolving in terms of sophistication and scope. Its ability to autonomously spread across projects, leveraging compromised credentials and legitimate infrastructure, makes it a persistent threat to developers and organizations relying on open-source packages.

Emerging Trends

• Self-Propagation: The most concerning aspect of Shai-Hulud is its self-propagation capability. Using stolen credentials, the malware can modify and republish packages in other projects, creating a chain reaction that is difficult to contain.
• Exploitation of SLSA: The fact that malicious packages can obtain valid SLSA Build Level 3 attestations demonstrates how current security standards can be manipulated. This raises critical questions about the reliability of provenance attestations.
• Diversified Targeting: From the initial compromise of TanStack and Mistral AI packages, the campaign has spread to projects like Bitwarden CLI, SAP, and others, indicating a broad and opportunistic targeting strategy.

Long-Term Risks

The impact of Shai-Hulud goes beyond mere credential exfiltration. The malware's persistence in IDE configurations and its ability to survive the uninstallation of malicious packages create significant risks:

• Prolonged Compromise: Even after the removal of infected packages, residual files can maintain unauthorized access to developers' machines.
• Exposure of Sensitive Credentials: Stolen credentials can be used to access internal resources, further compromising organizations' security.
• Erosion of Trust: Shai-Hulud's ability to evade existing security controls could undermine trust in open-source package ecosystems.

Best Practices for Mitigation

To protect against similar attacks, organizations should adopt a multi-layered approach to supply chain security:

Immediate Measures

• Comprehensive Audits: Conduct a thorough audit of all packages in use, verifying versions and origins.
• Credential Rotation: Immediately rotate all potentially compromised credentials, including GitHub tokens, npm tokens, AWS credentials, and others.
• Blocking C2 Infrastructures: Block known IP addresses and domains associated with the malware at the DNS or proxy level.

Long-Term Strategies

• Adoption of SLSA: Fully implement SLSA standards to ensure a more secure supply chain.
• Behavioral Analysis: Integrate behavioral analysis tools during package installation to detect anomalous activities.
• Lockfile-Only Installation: Configure systems to use only lockfiles to prevent unauthorized automatic updates.

Future Perspectives

The Shai-Hulud campaign underscores the critical importance of investing in software supply chain security. As attacks become more sophisticated, it is essential for developers and organizations to adopt proactive measures to protect their development ecosystems. Collaboration between security providers, package maintainers, and the open-source community will be key to addressing this evolving threat.

Additional Resources

• BleepingComputer: Shai-Hulud Emerges
• BleepingComputer: Secret Exposure

These reports provide further technical details and context on the Shai-Hulud campaign, helping developers and organizations better understand the threat and implement appropriate security measures.