Forest Global Training Partners

Cyber Risks · Krebs on Security

Self-Replicating Worm Hits 180+ Software Packages

Summary: At least 187 code packages on the JavaScript repository NPM were infected with a self-replicating worm dubbed Shai-Hulud that steals developer credentials and publishes them to public GitHub repositories, with the first compromised package altered on Sept. 14 around 17:58 UTC. The malware uses stolen NPM tokens to copy itself into the 20 most popular packages a victim can access, briefly infected at least 25 CrowdStrike-managed packages, uses TruffleHog to hunt for credentials, enumerates AWS, Azure and Google Cloud secrets, and deliberately skips Windows systems.

Bottom line: Aikido researcher Charlie Eriksen said that once the first person was compromised there was no stopping it, and that a single accidental infection could restart the spread - meaning every developer token in your environment is a potential ignition point. CrowdStrike rotated its keys and said its Falcon sensor and customers were not impacted, but the worm's reach into cloud secrets and SSH keys is the exposure to sit with.

Read the original at Krebs on Security ↗

Topics
Malware
Related