Microsoft Threat Intelligence has identified a large-scale supply chain attack impacting over 400 npm packages, including critical ecosystem dependencies like keyv and flat-cache. The campaign leverages a sophisticated, self-propagating worm variant dubbed ‘Mini Shai-Hulud’, which utilizes heavily obfuscated Bun-based JavaScript payloads.
Attack Methodology
The malware functions by exploiting npm preinstall lifecycle hooks, executing malicious code on developer workstations and CI/CD runners before security checks can initiate. Once active, the worm performs several critical tasks:
- Credential Theft: Scans local environments for npm, GitHub, cloud (AWS), Kubernetes, and HashiCorp Vault secrets.
- Propagation: Uses stolen tokens to automatically download packages, inject the malicious payload, increment version numbers, and republish the compromised packages to the npm registry.
- Persistence: Injects malicious configurations into Claude and Visual Studio Code settings within repositories to ensure re-infection.
- Exfiltration: Data is encrypted and exfiltrated via HTTPS, with GitHub repositories serving as a fallback channel.
Impact and Mitigation
Organizations should treat any environment where these packages were installed as compromised. This includes developer workstations and automated build pipelines.
Recommended actions for remediation:
- Rotate Credentials: Immediately revoke and rotate all secrets that were accessible to the affected systems.
- Clean Rebuilds: Purge npm/yarn caches and rebuild infrastructure from trusted, known-good sources.
- Hardening: Update to npm CLI v12 to utilize ‘min-release-age’ features and review GitHub Actions OIDC publishing permissions to prevent unauthorized automated releases.
- Detection: Microsoft Defender XDR provides specific detections for ‘ShaiLoader’, ‘MalBun’, and ‘ShaiWorm’. Security teams should monitor for the identified Indicators of Compromise (IOCs), such as the setup.mjs loader and connections to domains like npm-cache[.]com.
This incident highlights the critical need for robust CI/CD security and proactive monitoring of supply chain dependencies to prevent widespread, automated propagation of malicious code.
