Another massive NPM worm: 444 packages with 2 billion monthly downloads infected with malware
I wake up, there’s a new supply chain attack.
Image by Cybernews.
- Malware infected at least 444 npm packages spanning 2,000 versions, threatening software with over two billion monthly installs.
- Attackers compromised maintainer Jared Wray's account, then used stolen credentials to automatically poison more packages.
- Infected installs steal hundreds of credential types and tamper with Claude and Visual Studio Code configurations.
- Experts urge affected organizations to assume exposure, rotate secrets, audit repositories and packages, and clean infected systems.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A new wave of infections is spreading across some of the most widely used software packages on NPM, the world's largest software repository, stealing developers' credentials.
At least 444 software packages across more than 2,000 versions, with combined over 2 billion monthly installs, have been injected with malware in less than 24 hours, as tracked by Wiz, a cloud security company.
A significant chunk of the open-source ecosystem was hit after a compromise of just a single developer on August 4th. Attackers unleashed a self-propagating worm that feeds on stolen developer credentials and poisons more software packages.
The “patient zero” was a GitHub account belonging to Jared Wray, a maintainer of massively dependent-on keyv and cacheable open-source projects that provide data management and caching for JavaScript applications.
When Wray lost access to the accounts, it took hours for the developer to receive any response from GitHub and npm, despite submitting multiple support tickets and even asking for help on X.
Malicious keyv version 6.0.0 was released first – it alone has 604 million downloads every month. Other malicious packages were released in quick succession: cacheable (29 million monthly downloads), flat-cache (565 million/month), file-entry-cache (557 million/month), and many others.
The worm then used stolen credentials to publish even more trojanized packages from other accounts.
“We are also seeing very active community spread of this supply chain worm to other maintainers and packages, including major organizations,” Aikido, a cybersecurity company, warns in a report.
An update or fresh install of the affected packages leads to a complete compromise of a system – the malware steals developer credentials, such as .env files, npm and GitHub tokens, AWS, Kubernetes secrets, as well as over 200 other types of credentials, from SSH keys to VPN configurations.
“Every poisoned version carries the same infection pattern: a preinstall dropper that downloads the legitimate Bun JavaScript runtime, and a 710KB obfuscated second stage that steals credentials, publishes more malicious packages, and burrows into AI developer tooling,” StepSecurity explains in its report.
Malware is a descendant of Shai-Hulud
NPM has been under near-constant attack by worms this year, most notably various variants of Shai Hulud, which was open-sourced by the threat actor that created it, heavily using AI.
StepSecurity’s analysis unveils that the new malware is a highly evolved descendant of Shai-Hulud 2.0.
While the payload contains some of the most distinctive markers from the earlier variants, it also leaves the same distinct description in public GitHub repositories: “Shai-Hulud: Here We Go Again,” as noted by Microsoft.
“The payload’s most significant capability is automated propagation. After obtaining an npm publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages,” Microsoft said in an advisory.
To establish persistence, the malware also poisons Claude and Visual Studio Code configuration files in victim repositories.
The malware introduces some new updates. It receives command-and-control server domains from the Ethereum blockchain, allowing the operator to modify it on the fly. It steals credentials from 70% more targets, and new additions include Claude, OpenAI, Codex, Cursor, and Gemini; cryptocurrency keystores for Foundry, Solana, and Monero, and more.
“The dead-man’s switch has been updated to be selectively armed based on response from the C2,” Wiz noted.
And the updated malware intimidates developers: “If you block this API key it will crash the live production servers of all third party clients.”
All advisories recommend the same: all affected developers and organizations should assume exposure, rotate all secrets, audit released packages and their own repositories for signs of compromise, clean infected systems, and add defenses to help prevent similar incidents in the future.
The full scale of the attack is not yet clear, because the malware spreads through maintainer credentials, and thousands of them might’ve been compromised already.
