Leaked Shai-Hulud Malware Fuels New npm Infostealer Campaign

Overview

Shai-Hulud, an infostealer malware whose source code recently leaked, is now being leveraged in new attack campaigns. These attacks specifically target the Node Package Manager (npm) index, with threat actors distributing infected packages to compromise developer environments. This development represents a critical supply chain threat for organizations relying on npm dependencies, as successful compromise can lead to data exfiltration.

Technical Analysis

• Malware Type: Shai-Hulud is an infostealer, designed to exfiltrate sensitive data from compromised systems.
• Attack Vector: Malicious or compromised packages are published to the public npm registry. Developers who install these packages inadvertently introduce the malware into their development environments.
• Prerequisites: A developer must install an infected npm package for the malware to execute.
• Execution: Upon installation, the malware executes its infostealing routines, though specific technical details of its execution chain within an npm context are not fully public at this time.
• Impact: Successful execution leads to the exfiltration of sensitive information from the compromised system, which may include credentials, private keys, or other proprietary data.

Detection

• Monitor npm package installations for unusual or newly published packages, especially those from unknown maintainers or with low download counts.
• Analyze network traffic originating from node.exe or npm processes for connections to suspicious external IP addresses or domains.
• Implement file integrity monitoring (FIM) on critical system files and developer-related configuration files that could be targeted by infostealers.
• Look for node.exe or npm processes accessing sensitive files outside of typical development workflows, such as browser credential stores (Login Data, key4.db), cryptocurrency wallet files (wallet.dat), or SSH keys.
• Monitor for unusual child processes spawned by node.exe or npm that are not part of standard package installation or execution.

Mitigations

1. Supply Chain Security: Implement strict policies for npm package usage, including vetting new dependencies, using private registries, and employing dependency scanning tools to identify known vulnerabilities or malicious components.
2. Least Privilege: Run development environments and npm commands with the lowest necessary user and network privileges to limit the scope of potential compromise.
3. Network Segmentation & Egress Filtering: Restrict outbound network connections from development machines to only necessary endpoints. Block connections to known malicious IPs and unexpected ports.
4. Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious process activity, file access patterns, and network connections indicative of infostealer behavior.
5. Developer Education: Educate developers on identifying suspicious npm packages, the risks of supply chain attacks, and best practices for securing their development environments.

References

• https://www.bleepingcomputer.com/news/security/leaked-shai-hulud-malware-fuels-new-npm-infostealer-campaign/

Indicators of Compromise

No public IOCs available at time of writing.

Detection Rules (Sigma)

Shai-Hulud Infostealer – Suspicious Node.js File Access

title: Shai-Hulud Infostealer - Suspicious Node.js File Access
id: 93f7e1b2-c8d4-4a0e-8e1c-5f6a0d2b1e3f
status: experimental
description: Detects suspicious file access by node.exe or npm processes to common browser credential locations, indicative of an infostealer.
logsource:
  product: windows
  service: sysmon
detection:
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\npm.cmd'
  selection_target_file:
    TargetFilename|contains:
      - '\Local Storage\leveldb\' # Chrome/Edge/Brave/Opera
      - '\Login Data'
      - '\Web Data'
      - '\Cookies'
      - '\key4.db' # Firefox
      - '\logins.json' # Firefox
      - '\wallet.dat' # Common crypto wallet file
  condition: selection_process and selection_target_file
level: high

MITRE ATT&CK

• T1598.003 — Spearphishing Link
• T1552.001 — Credentials In Files
• T1059.003 — Windows Command Shell