The federal government published a warning this week about an incident where hackers compromised hundreds of packages used by developers to build software. 

Last week, cybersecurity experts and tech companies raised alarms about a widespread software supply chain compromise involving Shai-Hulud — a self-replicating worm that was used to infect more than 500 packages embedded in various software.

The Cybersecurity and Infrastructure Security Agency (CISA) said that after gaining initial access, malicious hackers “deployed malware that scanned the environment for sensitive credentials.” The attackers targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for major cloud services.

The malware was then used to steal credentials, upload the credentials to a public repository and use an automated process to rapidly spread and inject code into other packages. 

CISA urged organizations to conduct reviews of all software leveraging the npm package ecosystem, checking for specific files that may have been affected. 

The agency added that all developer credentials should be rotated and that developers should look out for anomalous network behavior.

Xavier René-Corail, senior director of security research at GitHub, said they were notified of the Shai-Hulud attack on September 14 and found that it had been traced back to the compromised account of an unnamed maintainer. 

“By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers,” René-Corail explained on Monday. 

GitHub said in response to the incident, it immediately removed the 500 compromised packages from the npm registry to prevent further propagation of malicious software. The company, which is owned by Microsoft, also blocked the upload of new packages containing the malware’s indicators of compromise in an effort to cut off the self-replicating pattern.

“Such breaches erode trust in the open source ecosystem and pose a direct threat to the integrity and security of the entire software supply chain,” René-Corail wrote. “They also highlight why raising the bar on authentication and secure publishing practices is essential to strengthening the npm ecosystem against future attacks.”

Corrupted building blocks

Rami McCarthy, principal security researcher at cybersecurity company Wiz, told Recorded Future News that developers rely daily on a lot of small software building blocks, known as packages, to do their jobs. 

In this instance, hackers slipped malicious code into some of these building blocks, he explained, noting that this isn't uncommon. But in this case, the malicious code searched for secrets, like passwords, tokens and configuration files, and in some cases, even exposed private projects meant to stay hidden.

“What made this incident unique, and much worse, is that the malicious code also tried to spread. It would check each machine it runs on for any more packages that the machine has control over,” McCarthy noted. “When it finds them, it updates those new packages so they also have the malicious code. This is a supply chain software worm, and the first one we've seen succeed in this ecosystem.”

These types of supply chain attacks are dangerous because once secrets leak, attackers can move quickly to impersonate services, access internal systems and tamper with code. Because the attack spreads automatically, one compromise can quickly snowball, McCarthy said. 

McCarthy added that this attack got its start from a previous incident that leaked secrets, illustrating the lingering danger once these secrets have been exposed and the urgency with which organizations should respond.

The Shai-Hulud incident was the second large open source security fiasco to take place this month and comes as researchers continue to uncover more and more npm packages that have been corrupted.