Follow ZDNET: Add us as a favorite source On Google.
Key takeaways of zdnet
- Shai-Hulud is the worst NPM JavaScript attack.
- This software supply chain worm attack is still going on.
- There are some ways that you can stop such attacks.
Those of you are not Dune The fan, Shai-Huluda Desert Planet is a huge sandworm of Arracis. You do not want to come in their way. Now, this is also the name of one At least 180 NPM packagesAnd perhaps as 500 of them.
This is a major safety crisis for anyone programming in JavaScript and JavaScript runtime environment Node.jsJavaScript, by the way, is one of the most popular programming languages. This supply chain attack hits too much JavaScript developers.
Too: This 2FA fishing scam pwed a developer – and billions of NPM download billions
that’s because Node package manager JavaScript has a default package manager and software registry. This enables developers to install, manage and share packages – prebilt pieces of a reinstatus code called module – that depend on their JavaScript or Node.JS projects. NPM is such an open-source package library. Essentially, everyone who uses JavaScript uses it.
NPM also has a terrible security track record. After the month, the month, year -sal, hackers have successfully inserted malicious code in the NPM module. This, in turn, means that the corrupt code is automatically introduced in JavaScript-based programs used by the end users.
The most recent example of this was a week ago, when a fishing attack compromised 18 packages that were downloaded two billion times a week. this week’s The attack is very badHow bad? We do not know at all. Security experts are still working it, and when the worm has slowed down, it has not stopped yet.
How does a software supply chain attack
A software supply chain attack occurs when an attacker compromises the software during his development, which occurs by putting malicious code in its components before reaching the end users. Instead of directly attacking programmers or users, attackers exploit weaknesses in reliable third-party vendors, libraries, or development equipment that rely on developers. When compromise software or updates are distributed, often, customers, malicious payloads can affect many victims simultaneously.
Too: Your password manager is attacking: How to defend yourself against a new threat
These attacks are dangerous because:
- They take advantage of reliable relationships, allowing attackers to bypass direct security control.
- A successful agreement can affect thousands or millions of users, as their software includes tainted dependence or code.
- Modern outfits often use hundreds of third-party libraries or services, which means that the same violation in the chain may have aspirational effects.
As a final user, you don’t see it until it fly on your face when you update a program or service that you use every day, and it suddenly goes wrong. Or, as is far more likely, it starts mining of bitcoin on your server, starts stealing your company’s customer data, or installs ranges.
Shay-hullud attack
For example, in this case, package Tinycolor One of the first compromised programs to be spotted was. All this changes the colors of a program. That’s it. It has been downloaded, on average, 2.2 million times per week to be used in thousands of programs.
The infected version of Tinycolor, and all other packages was automatically pulled – we do not know how many – programs. Once, he deployed a malicious package with a worm. When they were installed, A Script scanned the environment for Raj Such as NPM tokens, github credentials, and cloud service application programming interfaces (API) key, such as AWS and Google Cloud.
Too: Best Password Manager for Businesses in 2025: Specialist Testing
These mysteries were then used to pass them at an attacker-controlled closing points. He then created a public github repository with stolen data, all “shay-hulud” labels.
Using these mysteries, especially the stolen NPM tokens, the worm was then certified as each compromise developer, scanned for other NPM packages, which they maintained, injecting its code, and published new, malicious versions. In this way, the worm continued to spread and spread and … well, you get this idea.
This caused exponential spread, affecting extremely popular libraries with billions of weekly downloads and hitting projects related to companies like security company Crowdastric,
Keep in mind that the name of the company’s game is protecting companies from such violations. It also comes a year later. A Crowdastrik update crashed millions of Windows PCs infamous, leading to the biggest wave of the blue screen of death.
Said that, according to a crudestroke spokesperson, “After detecting several malicious NPM packages in the public NPM registry, a third-party open source repository, we rapidly removed them and rotated our keys in public registries.
Too: 7 Password Rules Safety Experts live in 2025 – final can surprise you
Coming to insult the injury, Malware often installed open-sources Trpholhog equipment To hunt for further mysteries and private Github Repository. Once it got this private repository, it made public clones among them. Then, as a security company, Reversinglabs Keep it, “Each newly created package has been modified with postinstall action When an unheard user downloads the compromised package, the malicious bundle will execute the JS. It is always repeated because the worm finds to infect new developers, and then uses them to spread further. “And went on it and on it.
The total scope of the outbreak is still unknown. Worm’s functions highlighted the secrets in at least 700 Github Repository.
Too: The most powerful safety facility of your Android phone is hidden and closed by default – turn it on now
How bad is this really? Developer Security Company Chaingard CEO Dan Lorenk wrote on LinkedIn, “This wave of NPM attacks looks different… I am fulfilling development/swallowing from more than some companies, until they solve it. “This is not the usual business as usual.
NPM verses and affected companies are beating the foot to remove malicious packages, rotate credentials and warn the developer community. Safety vendors such as Palo Alto Network, trend MicroAnd Crowdastric has issued emergency guidance, recommending strong credential safety, immediate token rotation and malware scan for any system that install NPM packages in recent times.
How to stop software supply chain attacks
Software supply chain attacks have become common. They are not new. We have slowed down to identify how dangerous these attacks are. We should have learned our lesson in 2020, when we violated solarwinds to Russian-Linked attackers and thousands of solarwind customers should penetrate through malicious codes injected into the company’s network monitoring software.
We did not. So, here is how you can slow down the supply chain attacks, if they are not stopped completely.
Too: 3 Reasons VPN use is determined to explode worldwide – and it may apply to you
For the beginning, here is the cold, difficult truth. If you are a developer, you cannot rely on your dependence anymore. Duration. End of statement. Yes i know Linus rule“Enough eyeballs, all insects are shallow,” and you do. But it only works when there is enough eyeballs. You can leave the naive perception that open source means safe software. In the best case, this is true, but visually relying in programs from NPM or any other public software repository is just asking for trouble.
So, admit that open-source dependence is now a main part of your risk profile. Start treating software consumption seriously: Set the policy, track whatever you are used, which you use with a living software bill of materials (SBOM), and keep those components on a small lease.
Too: Navigating AI-operated cyber threats in 2025: 4 expert safety tips for businesses
You also have to stop updating your components automatically in the latest version. Instead, update only up-to-date, supported versions. In form of Openssf Put into Open source consumption manifestoYou should understand the actual risks by closing the eye using the open-source code.
Let’s get practical and specific.
1. Development and construction environment
2. Map of all dependence and manage
- Maintain a Sbom for every project; Track all dependence. Yes, all of them – yes, direct and transitive.
- Only maintained well, use reliable open-source package. Provence and seller checks the reputation before adding new components.
- Automate periodic scanning for weaknesses Software composition analysis tool. Immediately removed or removed the patch.
3. Secure CI/CD pipeline
- Integrate static, dynamic and interactive security scans in CI/CD pipelines to automatically tested every committe and bridge request for weaknesses.
- Use Role-based access control (RBAC) For construction and deployment resources. Regular audit permissions according to the least privilege.
- Sign, verify, and review all software artifacts from time to time, ensuring that updates come from reliable sources and form reproduction.
4. Monitoring, educated and reaction
- Deploy real -time danger intelligence feed and monitor for discrepancies in build pipelines, repository and application behavior.
- Provide running training for developers on safe coding, social engineering and supply chain attack awareness.
- Test your response plan by running violations and events, ensuring that you are ready to react rapidly if you are threatened. (Note: I said “when,” no “if.”)
- Everything audit. If you detect a common weaknesses and exposure (CVE), do not wait to answer. If necessary, test, patch and quarantine the affected code.
5. Cooperate upwards and downwards
- Attach upstream maintenors and seller support for rapid fix. Do not wait for public exploits to appear. The open source works well only when we all work on it. You can not just consider everyone well above.
- Assess suppliers, partners and important third-party equipment to comply with supply chain safety best practices. SBOM and regular safety reviews are required.
By following these steps and embedding safety at each stage of your software development, you will dramatically reduce your exposure for software supply chain attacks. The way they are coming so fast and often, you can still face them, but at least you have reduced your exposure. You get success. We all need it.
