The Cybersecurity and Infrastructure Security Agency urged security teams to monitor their systems following a massive supply chain attack that struck the Node Package Manager ecosystem.
The attack, tracked under the name Shai-Hulud, involved a self-replicating worm that compromised more than 500 software packages, according to StepSecurity.
After gaining access, a malicious attacker injected malware and scanned the environment for sensitive credentials. The credentials included GitHub Personal Access Tokens and application programming interface keys for various cloud services, including Amazon Web Services, Google Cloud Platform and Microsoft Azure.
The stolen credentials were uploaded to an endpoint controlled by the attacker and then uploaded to a public repository called Shai-Hulud.
Researchers at Palo Alto Networks said the attacker used an LLM to write the malicious script, according to an updated blog post released Tuesday.
GitHub on Monday said it took action to mitigate the impact of the attacks. GitHub has removed more than 500 packages from the npm registry. In addition, new packages that contain the malware’s indicators of compromise have been blocked.
CISA is urging security teams to take a series of mitigation steps to make sure their environments were not compromised. They include the following measures:
- Perform a dependency review of all software that leverages the npm package ecosystem.
- Look for cached versions of affected dependencies in artifact repositories as well as dependency management tools.
- Promptly rotate all developer credentials.
- Implement phishing-resistant multifactor authentication on developer accounts.
