‘Shai-Hulud: Here We Go Again’: Thousands of npm packages compromised in ‘Chaindrop’ malware campaign where hackers taunt victims

Security experts have issued an alert over a new infostealer malware campaign targeting npm packages.

Dubbed ‘Chaindrop’, the malware is a strain of the notorious Shai-Hulud infostealer used in repeated campaigns against software repositories.

According to researchers at security firm Aikido, the campaign kicked off when attackers compromised a GitHub account belonging to a maintainer at key-value storage library, keyv.

Notably, the same maintainer owns several highly-popular repositories, enabling hackers to inject the infostealer worm across the “entire package family” – which stands at roughly 127 million weekly npm downloads.

All told, Aikido warned that some 444 packages (across 1,381 versions) have been compromised so far. Combined, these boast a total of more than two billion monthly downloads.

Packages affected include:

• keyv
• flat-cache 6.1.24
• file-entry-cache 11.1.6
• cacheable-request 13.0.20
• cacheable 2.5.1
• @cacheable/memory 2.2.1
• cache-manager 7.2.10
• @cacheable/node-cache 3.1.2
• @cacheable/utils 2.5.1
• @cacheable/net 2.1.1
• ecto 5.0.1

How Chaindrop works

According to Aikido, the infostealer harvests credentials from victim environments, encrypts findings, and exfiltrates them to a public GitHub repository. The description on said repository reads: “Shai-Hulud: Here We Go Again”.

“Once credentials are harvested, the payload encrypts the entire bundle before sending it anywhere,” researchers explained.

“Only the attacker, who holds the corresponding RSA private key, can decrypt what gets uploaded. This means the stolen data sits in plain sight on public infrastructure but is unreadable to anyone else.”

Crucially, the payload contains “worm-like propagation” capabilities to infect packages of other maintainers that have installed a compromised package, making it extremely dangerous.

“Using the stolen npm token, the payload calls https://registry.npmjs[.]org/-/npm/v1/tokens to list every package that token has publish rights to, then fetches and unpacks the current tarball for each one,” Aikido noted.

A host of credentials and tokens are at risk, Aikido noted, including:

• Npm tokens
• GitHub tokens
• AWS credentials
• Kubernetes secrets
• HashiCorp Vault tokens
• Stripe and Slack tokens

Shai-Hulud still haunting developers

The Chaindrop campaign marks the latest in a string of attacks using variants of the Shai-Hulud malware. In May this year, the threat group behind the worm, TeamPCP, published its source code in a GitHub repository.

Research from Datadog Security Labs found that while this was quickly taken down, multiple copies are believed to have been made.

Analysis of the source code uncovered a “complete, production-grade offensive framework that accounts for nearly every TTP previously attributed to TeamPCP,” researchers noted.

In the months since, repeated warnings have been issued about new, improved variants of Shai-Hulud. As ITPro reported last month, a new variant dubbed ‘Miasma’, was identified and being used to target developers.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.