EXECUTIVE SUMMARY
The Shai-Hulud threat actor is behind a new campaign targeting the npm ecosystem, compromising the maintainer of a widely used key-value storage library and deploying a self-propagating worm called CHAINDROP. This worm uses stolen npm credentials to backdoor co-owned packages, with over 400 unique packages compromised, affecting multiple sectors and regions. The attacker's goal is to steal sensitive credentials and exfiltrate them, with the potential for significant disruption and data theft.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
The Shai-Hulud threat actor is behind a new campaign targeting the npm ecosystem, compromising the maintainer of a widely used key-value storage library and deploying a self-propagating worm called CHAINDROP. This worm uses stolen npm credentials to backdoor co-owned packages, with over 400 unique packages compromised, affecting multiple sectors and regions. The attacker's goal is to steal sensitive credentials and exfiltrate them, with the potential for significant disruption and data theft.[emaillocker id="1283"]
The malware infects systems through a preinstall hook in package.json, which abuses a legitimate npm feature to run arbitrary commands before a package is installed. Once inside, the malware delivers a cross-platform payload that targets Linux, macOS, and Windows platforms, using a dropper to execute the payload and maintain control. The payload is heavily obfuscated and contains a credential harvester that scans for sensitive credentials, including AI tooling and cloud provider credentials.
This threat is significant for organisations due to its broad impact and potential for disruption, making it difficult to detect and recover from. To defend against this threat, organisations should take defensive actions such as revoking and regenerating compromised credentials, checking for unauthorized commits, and enabling two-factor authentication on npm accounts. Additionally, organisations should consider adding a soak period for new package updates and upgrading to npm 12 or later to block preinstall hooks by default, to reduce the risk of compromise and protect sensitive data.
THREAT PROFILE:
| Tactic | Technique ID | Technique | Sub-technique |
| Initial Access | T1078.004 | Valid Accounts | Cloud Accounts |
| Initial Access | T1195.001 | Supply Chain Compromise | Compromise Software Dependencies and Development Tools |
| Execution | T1059.007 | Command and Scripting Interpreter | JavaScript |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Credential Access | T1555.001 | Credentials from Password Stores | Keychain |
| Credential Access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Credential Access | T1555.004 | Credentials from Password Stores | Windows Credential Manager |
| Exfiltration | T1048.003 | Exfiltration Over Alternative Protocol | Exfiltration Over Unencrypted Non-C2 Protocol |
REFERENCES:
reports contain further technical details:
https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain
https://cybersecuritynews.com/shai-hulud-chaindrop-worm-backdoors/