EXECUTIVE SUMMARY
A highly sophisticated credential theft worm, known as Shai-Hulud, has been identified in a compromised version of the @bitwarden/cli npm package. This widely-used package, with over 78,000 weekly downloads, was infected with a multi-stage worm that targets developer credentials, including SSH keys, cloud secrets, and even MCP configuration files. The attacker appears to have bypassed Bitwarden's trusted publishing controls by infecting the CI/CD pipeline itself, allowing a malicious package to be published under the legitimate @bitwarden name. The ultimate goal of this campaign is to steal sensitive credentials and disrupt the operations of affected organizations.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
A highly sophisticated credential theft worm, known as Shai-Hulud, has been identified in a compromised version of the @bitwarden/cli npm package. This widely-used package, with over 78,000 weekly downloads, was infected with a multi-stage worm that targets developer credentials, including SSH keys, cloud secrets, and even MCP configuration files. The attacker appears to have bypassed Bitwarden's trusted publishing controls by infecting the CI/CD pipeline itself, allowing a malicious package to be published under the legitimate @bitwarden name. The ultimate goal of this campaign is to steal sensitive credentials and disrupt the operations of affected organizations.[emaillocker id="1283"]
The malware infects systems by introducing a malicious preinstall hook that points to a new file bw_setup.js, which fires automatically on npm install with no user interaction required. This file acts as a cross-platform bootstrapper, detecting the victim's OS and architecture, downloading the legitimate Bun JavaScript runtime, and using it to execute the Stage 2 payload. Stage 2, contained in a heavily obfuscated 10 MB payload called bw1.js, is a fully featured credential harvester and supply chain worm that closely mirrors previous Shai-Hulud waves. The malware scans a hardcoded list of high-value credential files on the victim's machine, including SSH private keys, cloud credentials, and Git remote URLs, and contacts two C2 URLs to exfiltrate stolen data.
This threat is significant for organisations, particularly those in the developer community, as it can lead to data theft, disruption, and financial losses. The worm's self-propagating nature and ability to bypass security controls make it challenging to detect and recover from. To mitigate this threat, organisations should prioritise patching and updating their npm packages, implement robust monitoring and logging, maintain regular backups, and ensure endpoint protection is in place. Additionally, developers should be cautious when installing packages and verify the integrity of their dependencies.
THREAT PROFILE:
THREAT PROFILE:
|
REFERENCES:
reports contain further technical details:
https://securityaffairs.com/191215/malware/checkmarx-supply-chain-attack-impacts-bitwarden-npm-distribution-path.html
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise