Ethical Hacking News
npm Supply Chain Under Siege: A Second Wave of Devastating Attacks
The npm registry has been targeted by a second wave of devastating attacks, dubbed "Sha1-Hulud" by researchers, which have left thousands of repositories compromised. The attack uses a new variant of malware that executes malicious code during the preinstall phase of npm packages. The attackers have added a preinstall script that stealthily installs or locates the Bun runtime and runs a bundled malicious script. The malware attempts to exfiltrate secrets, but if it fails, it destroys the victim's entire home directory. Organizations are urged to take proactive measures to protect themselves against such attacks, including scanning for impacted packages and removing compromised versions.
The world of cybersecurity has witnessed numerous breaches and attacks in recent years, with the npm registry being a prime target for malicious actors. In a recent development that underscores the ever-evolving nature of cyber threats, a second wave of devastating attacks on the npm registry has left thousands of repositories compromised, according to reports from multiple security vendors. This latest wave of attacks, dubbed "Sha1-Hulud" by researchers, has brought into focus the vulnerabilities in the supply chain and the need for organizations to take proactive measures to protect themselves against such threats.
The npm registry, which is a treasure trove of open-source packages, has long been a target for malicious actors seeking to exploit its vast repository of packages. In September 2025, a Shai-Hulud attack compromised hundreds of npm packages, publishing stolen secrets on GitHub and executing malicious code that scanned developer machines for credentials. The latest attack, dubbed Sha1-Hulud Wave A, has left over 25,000 repositories affected across about 350 unique users.
According to Wiz, the security firm that spotted the attacks, the Sha1-Hulud campaign introduces a new variant of malware that executes malicious code during the preinstall phase of npm packages. This significantly increases potential exposure in build and runtime environments, making it essential for organizations to scan all endpoints for the presence of impacted packages and remove compromised versions with immediate effect.
The attackers have also been found to add a preinstall script ("setup_bun.js") in the package.json file, which is configured to stealthily install or locate the Bun runtime and run a bundled malicious script ("bun_environment.js"). The malicious payload carries out a sequence of actions through two different workflows:
1. Registers the infected machine as a self-hosted runner named "SHA1HULUD" and adds a workflow called .github/workflows/discussion.yaml that contains an injection vulnerability and runs specifically on self-hosted runners, allowing the attacker to run arbitrary commands on the infected machines by opening discussions in the GitHub repository.
2. Exfiltrates secrets defined in the GitHub secrets section and uploads them as an artifact, after which it's downloaded, followed by deleting the workflow to conceal the activity.
This is not the first time that the npm registry has been targeted by malicious actors. In September 2025, a Shai-Hulud attack compromised hundreds of npm packages, publishing stolen secrets on GitHub and executing malicious code that scanned developer machines for credentials. The latest attack seems to be more aggressive, with malware attempting to destroy the victim's entire home directory if it fails to authenticate or establish persistence.
Koi Security has called the second wave a lot more aggressive, adding that the malware attempts to destroy the victim's entire home directory if it fails to authenticate or establish persistence. However, this wiper-like functionality is triggered only when certain conditions are satisfied, including the inability of the attacker to:
1. Authenticate to GitHub
2. Create a GitHub repository
3. Fetch a GitHub token
4. Find an npm token
In other words, if Sha1-Hulud is unable to steal credentials, obtain tokens, or secure any exfiltration channel, it defaults to catastrophic data destruction. This marks a significant escalation from the first wave, shifting the actor's tactics from purely data-theft to punitive sabotage.
To mitigate the risk posed by this threat, organizations are being urged to take proactive measures to protect themselves against such attacks. These include scanning all endpoints for the presence of impacted packages, removing compromised versions with immediate effect, rotating all credentials, and auditing repositories for persistence mechanisms by reviewing .github/workflows/ for suspicious files such as shai-hulud-workflow.yml or unexpected branches.
In conclusion, the npm supply chain under siege is a stark reminder of the ever-evolving nature of cyber threats. As organizations continue to rely on open-source packages for their development needs, it is essential for them to be vigilant in protecting themselves against such threats. By taking proactive measures and staying informed about emerging threats, organizations can minimize the risk of being compromised by malicious actors.
npm Supply Chain Under Siege: A Second Wave of Devastating Attacks
Related Information:
https://www.ethicalhackingnews.com/articles/The-npm-Supply-Chain-Under-Siege-A-Second-Wave-of-Devastating-Attacks-ehn.shtml
https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html
https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
Published: Mon Nov 24 07:37:09 2025 by llama3.2 3B Q4_K_M
