A supply-chain attack has affected more than 400 npm packages maintained by unrelated publishers, using compromised package releases to steal developer credentials and spread to other projects.
Microsoft Threat Intelligence said the malicious releases contain a variant of the Mini Shai-Hulud worm. Affected packages include software associated with widely used JavaScript ecosystems, such as keyv, flat-cache, and cache-manager.
The malware is delivered through modified npm package tarballs and starts automatically through a preinstall lifecycle hook. This allows it to execute before package installation finishes on developer machines or continuous integration and continuous delivery systems.
npm lifecycle scripts are part of the normal package installation process. npm documentation lists preinstall, install, and postinstall among the scripts that can execute during installation, while newer npm tooling provides controls over which dependencies are allowed to run install-time scripts.
Many of the affected releases appeared as ordinary patch-version updates without corresponding source-code commits, pull requests, or release tags. Microsoft said this pattern indicates attackers modified and published package archives directly rather than compromising the public source repositories behind each package.
npm provenance provides cryptographic information about where and how an eligible package was built, linking a publication to its source repository and build environment. Microsoft found that many malicious registry releases in this campaign had no corresponding source-code commit, pull request, tag, or legitimate release.
Developer credentials become a route to further packages
Once running, the malware checks whether it is operating on a developer workstation or inside a CI/CD environment. On developer systems, it can detach from the installation process and continue running in the background.
In CI environments, the malware remains within the active build job, where workflow secrets, runner credentials, and publishing permissions can be available. GitHub Actions workflows can access configured secrets and, when granted id-token: write, request OpenID Connect tokens for authentication with external services.
Microsoft said the malware remains attached to the active CI job so it can access credentials available during that workflow run. The payload collects credentials from environment variables, local configuration files, shell histories, command-line tools, SSH keys, and GitHub Actions runner memory.
Recovered credentials are then tested against services including npm, GitHub, Amazon Web Services, Kubernetes, and HashiCorp Vault. The malware also uses valid credentials to query service APIs and retrieve additional resources or secrets available to those identities.
GitHub tokens are checked for their available permissions before the malware searches for writable repositories. It also identifies workflows that could expose additional secrets or provide publishing access.
Microsoft said the attack contains a separate publishing path targeting GitHub Actions workflows configured to use npm trusted publishing.
npm trusted publishing allows authorised CI/CD workflows to publish packages through OpenID Connect rather than relying on a long-lived npm publishing token. GitHub Actions workflows using this method must be able to request an OIDC token, which npm accepts from the configured workflow for publication.
npm also generates provenance attestations for eligible public packages published through supported trusted-publishing workflows. Microsoft said packages republished through the malicious OIDC path can retain valid provenance because the publication originates from a legitimate workflow identity.
The worm’s main propagation mechanism relies on npm publishing privileges recovered from compromised environments.
After obtaining a usable publishing token, the malware identifies packages that can be modified by the affected account. It downloads the latest package archive, inserts its payload and loader, replaces lifecycle scripts, increases the patch version, and publishes the modified package.
Microsoft said one stolen npm publishing token can produce malicious patch releases across every package available to that publisher. Evidence from the campaign points to stolen maintainer credentials as the initial access route, while later infections used stolen npm tokens and, in some workflows, GitHub Actions publishing permissions.
Exposure is not limited to packages directly listed by a project. npm installs packages together with their dependencies, while lockfiles record the resolved versions used across the dependency tree.
Microsoft recommends checking dependency trees and lockfiles for affected versions, including packages introduced through transitive dependencies.
GitHub, coding tools, and shared build systems extend the attack path
The attack also extends beyond the npm registry. Stolen GitHub credentials can be used to modify repositories and create another route for the malware to execute.
The payload targets configuration paths used by Claude and Visual Studio Code, including .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs.
Microsoft said these injected configuration files can restart the payload during later Claude or Visual Studio Code activity, even after the original npm installation has finished.
A separate fallback mechanism can install a component that monitors stolen GitHub credentials. Microsoft said the recovered code also contains a destructive handler that can be triggered if the monitored token is revoked.
Information collected from compromised environments is converted to JSON, compressed, and encrypted before it is transmitted.
The malware uses AES-256-GCM encryption for the collected data and encrypts the AES key using the attacker’s RSA public key. It then attempts to send the results to an attacker-controlled HTTPS endpoint.
Microsoft identified npm-cache[.]com as an active domain used during its analysis. Other infrastructure observed in the campaign included pypi-get[.]com and js-mirror[.]com.
The malware can change its active endpoint using an on-chain contract or retrieve an alternative address from a cryptographically signed GitHub commit.
If its primary communications channel is unavailable, the payload can create a public GitHub repository and upload encrypted results there. Microsoft observed repositories using the description “Shai-Hulud: Here We Go Again” as part of this fallback process.
One fallback method handles stolen GitHub tokens differently, encoding them twice with Base64 rather than encrypting them.
GitHub Actions can cache files such as dependencies downloaded through package managers, including npm and Yarn between workflow runs. When a matching cache is available, its contents can be restored to a runner for use by a later job.
GitHub states that cache contents are not signed or verified and warns that poisoned caches can lead to code execution in trusted workflows. Microsoft recommends purging npm and Yarn caches on exposed developer systems and build hosts, particularly where compromised package archives were written to shared CI caches.
Microsoft said organisations that installed an affected package while npm lifecycle scripts were enabled should consider the associated developer machine or build runner potentially compromised.
Removing an affected dependency is only one part of the remediation process. Microsoft said investigations should also cover npm publishing activity, GitHub repository and workflow changes, cloud access, secret stores, CI caches, and artifacts produced by affected build systems.
Credentials accessible to compromised identities should be revoked and replaced from an unaffected system. Microsoft also recommends rebuilding affected machines and software artifacts using trusted dependencies.
Shared development infrastructure requires similar checks. Microsoft advises rebuilding exposed base images and golden build runners so later jobs do not inherit affected caches or persistence from an earlier execution.
Microsoft outlines release safeguards
Microsoft recommends pinning known-good package versions and reviewing dependency trees, lockfiles, artifact repositories, and CI caches for affected releases, including transitive references.
The company also recommends npm CLI 12 and its min-release-age feature, which allows teams to prevent very recently published package versions from being selected until a configured period has passed.
Current npm documentation says dependency install scripts that are not covered by a project’s allowScripts policy are blocked by default. npm also provides strict-allow-scripts, which turns an unreviewed install script into an installation error rather than skipping it with a notice.
Organisations that publish software packages should also review automated release processes following an affected build or developer account. Microsoft recommends checking token scopes, workflow approvals, protected environments, package provenance, and unusual automated publishing activity where GitHub Actions or other CI/CD systems are authorised to create releases.
(Photo by Mohammad Rahmani)
See also: Microsoft adds AI and DevSecOps pillars to zero trust tools
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer Tech News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.