Massive Shai-Hulud Supply Chain Campaign Compromises npm Ecosystem, Including keyv and cacheable

The "Shai-Hulud" campaign (specifically the "ChainDrop" wave) is a sophisticated supply chain attack targeting the npm ecosystem via hijacked maintainer accounts for widely used packages like keyv and cacheable. Utilizing malicious npm preinstall scripts, the threat actor deploys a self-propagating "Mini Shai-Hulud" worm and an infostealer. The attack leverages OIDC provenance to bypass integrity checks and employs obfuscated JavaScript files, such as math_init.js and Math_Symbol.js, to exfiltrate AWS credentials, GitHub tokens, Kubernetes secrets, and CI/CD environment variables. With over 440 compromised packages and 2 billion monthly downloads at risk, the campaign facilitates deep transitive infection across developer workstations and cloud infrastructure.

• Threat Campaign Overview: Shai-Hulud and ChainDrop

  • Sophisticated supply chain infiltration targeting the npm registry through account takeovers of high-profile maintainers.
  • Identified as a dual-threat mechanism: a high-speed infostealer paired with a "Mini Shai-Hulud" self-propagating worm.
  • Achieved widespread distribution by hijacking critical dependency nodes, most notably keyv and cacheable.

• Attack Mechanics: Execution & Evasion

  • Triggers malicious payloads during the installation phase using npm preinstall lifecycle scripts.
  • Employs highly obfuscated JavaScript payloads, specifically math_init.js and Math_Symbol.js, to evade static analysis.
  • Utilizes the Bun runtime during the ChainDrop wave to execute malicious logic.
  • Bypasses modern security integrity checks by abusing OIDC (OpenID Connect) provenance to present malicious updates as legitimate.

• Technical Impact: Data Exfiltration & Propagation

  • Targets high-value secrets including AWS credentials, GitHub tokens, Kubernetes secrets, and SSH keys.
  • Facilitates lateral movement across the dependency tree via transitive infection (e.g., affecting projects via ESLint).
  • Aims to compromise developer workstations, CI/CD build pipelines, and cloud-native production environments.

• Scale & Exposure: Ecosystem Blast Radius

  • Direct exposure involves more than 440 compromised packages within the npm registry.
  • Creates an enormous exposure surface involving an estimated 2 billion monthly package downloads.
  • Demonstrates systemic risk due to the deep, nested nature of modern JavaScript dependency trees and automated builds.

• Defensive Actions & Investigation

  • Audit dependency manifests for identified malicious filenames (math_init.js, Math_Symbol.js) and associated SHA-256 hashes.
  • Monitor CI/CD and automated build environments for unauthorized or anomalous npm lifecycle script execution.
  • Enforce strict secrets management and rotate all potentially exposed credentials, particularly cloud and CI/CD environment variables.