Major New Supply Chain Campaign Compromises Over 430 Packages and Two Billion Installs
Recent warnings from security researchers have unveiled a significant new campaign centered on the "Shai-Hulud" malware that has successfully compromised over 430 software packages, collectively racking up more than two billion installs each month. Dubbed the ChainDrop campaign, it marks a troubling trend in software supply chain security.
The genesis of the ChainDrop campaign can be traced back to August 4, when attackers gained unauthorized access to the GitHub account of a key maintainer associated with the widely used keyv library, which specializes in key storage. This library alone boasts around 127 million downloads on npm each week, making it a ripe target for exploitation. According to an analysis by Aikido Security, the attackers leveraged this control to introduce a credential-stealing worm into numerous other packages. This list includes popular dependencies like cacheable, which enjoys around 29 million downloads monthly, flat-cache with 565 million, and file-entry-cache with 557 million downloads.
The method of compromise was particularly alarming. The attackers managed to push malicious files directly to the main branch of the keyv library, effectively updating the codebase with a poisoned release. Given the legitimacy of the provenance signed by GitHub Actions, these corrupted versions were promptly published on npm, thereby distributing the threat to unsuspecting developers.
The resulting malicious packages contain an infostealer that hunts for valuable credentials, including npm tokens, GitHub tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, as well as tokens from services like Stripe and Slack. Information collected through this nefarious activity is encrypted and subsequently sent to a public GitHub repository, ominously titled "Shai-Hulud: Here We Go Again."
In a worrying parallel to past exploits, the ChainDrop campaign also exhibits worm-like traits. This allowed it to spread autonomously to other repositories and maintainers by exploiting the stolen tokens. Prominent organizations affected by this attack include Deliveroo, Ornikar, OneReach, Picsart, and Qlik, underscoring the extensive impact of this security breach across the tech industry.
To combat the repercussions of the ChainDrop campaign, both Microsoft and Wiz Security have published analyses that lay out indicators of compromise (IOCs) and essential mitigation strategies. According to their recommendations, developers should immediately identify and remove any affected package versions from their development and continuous integration environments. Furthermore, it is crucial to treat potentially compromised systems seriously and rebuild them if malicious packages have been installed.
Organizations are also urged to rotate any exposed credentials, including cloud service credentials, GitHub tokens, SSH keys, and other sensitive configurations. After the installation of compromised packages, it is vital to scrutinize cloud environments and source code for any signs of unauthorized access or suspicious activities. Continuous monitoring for published IOCs, such as relevant domains and file artifacts, must become a standard practice in order to safeguard against further incidents.
Katie Paxton-Fear, an ethical hacker and staff security advocate at Semgrep, commented on the situation, highlighting that the tactics employed in the ChainDrop campaign are not ground-breaking but rather an evolution of techniques previously observed in last year’s Shai-Hulud incidents. She emphasized that the worm efficiently steals developer credentials, using them to perpetuate further compromises throughout the trusted publishing workflows that many organizations rely upon.
While the arsenal of techniques used has not changed significantly, Paxton-Fear warned that organizations cannot afford to become complacent. It is crucial for developers to operate under the assumption that any package installation could potentially lead to a credential breach. Consequently, organizations must rotate exposed secrets, examine logs for unauthorized access, and conduct comprehensive audits of their own packages to check for infections.
The implications of the ChainDrop campaign extend far beyond the immediate damage it may cause to individual organizations. With vulnerabilities in the software supply chain becoming more pronounced, it is increasingly clear that developers and companies must invest in robust security frameworks to withstand such threats. As the software landscape continues to evolve, proactive measures, including dependency allowlisting and package integrity verification, must take precedence to protect against future supply chain attacks.