Shai-Hulud Campaign: 350+ npm Packages Compromised, 2B+ Monthly Downloads

The Hook: A sophisticated supply chain attack dubbed "Shai-Hulud" has compromised 350+ npm packages, including the popular keyv and cacheable libraries. The worm-like infostealer is exfiltrating credentials, environment variables, and crypto wallet data from CI/CD pipelines and developer workstations.

Technical Breakdown: – Attack Vector: Compromised maintainer accounts via credential stuffing/session hijacking, followed by malicious version bumps of legitimate packages – Payload Behavior: Worm-like propagation — infected packages scan the filesystem for .npmrc, .env, and SSH keys, then attempt to publish additional malicious packages using stolen tokens – Affected Packages: keyv, cacheable (and their transitive dependencies) — combined 2B+ monthly downloads – Exfiltration: Data sent to C2 infrastructure via DNS tunneling and HTTPS POST requests – Persistence: Malicious code embedded in postinstall scripts and prepublish hooks

Defense: – Pin dependency versions immediately — do not use ^ or ~ ranges for keyv/cacheable – Audit npm tokens and rotate any that have been used in CI/CD in the last 30 days – Monitor for unexpected postinstall script execution in your build logs – Consider using npm audit with --audit-level=critical and implement package allowlisting

Source: https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/