Listen to this Post
Introduction:
The cybersecurity landscape is reeling from the relentless, self-replicating Shai-Hulud 2.0 supply chain attack targeting the npm ecosystem. New analysis from Wiz Research reveals this is not a contained incident but an ongoing campaign perfecting the art of credential harvesting by exploiting the trusted relationships between version control systems (VCS), package managers, and CI/CD pipelines. With hundreds of thousands of secrets already exfiltrated, the aftermath poses a severe, lingering threat to organizations worldwide.
Learning Objectives:
- Understand the attack vectors and critical npm packages exploited in the Shai-Hulud 2.0 campaign.
- Learn how to audit your environments for compromise and rotate exposed credentials.
- Implement hardening measures for CI/CD systems and development workstations to prevent similar attacks.
You Should Know:
- The Anatomy of Infection: Targeted Packages and Attack Flow
The attackers strategically poisoned popular npm packages, with `@postman/tunnel-agent-0.6.7` and `@asyncapi/specs-6.8.3` accounting for approximately 60% of infections. These packages, once installed, executed malicious code that harvested secrets from the environment and `truffleSecrets.json` files, then propagated further.
Step-by-step guide explaining what this does and how to use it.
To check if your systems are infected, you must audit npm dependencies and running processes.
On Linux/macOS:
1. Find if malicious packages are installed in your project npm list @postman/tunnel-agent @asyncapi/specs 2>/dev/null | grep -E "(postman|asyncapi)" <ol> <li>Search for the presence of truffleSecrets.json files system-wide (indicative of the worm's activity) sudo find / -name "truffleSecrets.json" 2>/dev/null</p></li> <li><p>Check for suspicious Node.js processes ps aux | grep node | grep -v grep
On Windows (PowerShell):
1. Check installed npm packages Get-ChildItem -Path "C:\Users\AppData\Roaming\npm\node_modules" -Include "tunnel-agent", "asyncapi" -Recurse -ErrorAction SilentlyContinue <ol> <li>Search for truffleSecrets.json files Get-ChildItem -Path C:\ -Name "truffleSecrets.json" -Recurse -ErrorAction SilentlyContinue</p></li> <li><p>Examine Node processes Get-Process node | Format-List Id, Path, CommandLine
Immediately remove any detected malicious packages and quarantine affected systems.
- The Crown Jewels: Analyzing the 400,000 Stolen Secrets
The attack exfiltrated a staggering 400,000 unique secrets. Critically, only 2.5% were verified as valid upon discovery, with the majority being short-lived JSON Web Tokens (JWTs) for GitHub Actions. This highlights both the attack’s scale and a potential silver lining—many secrets were ephemeral.
Step-by-step guide explaining what this does and how to use it.
You must assume all secrets in compromised environments are exposed. Implement a mandatory rotation.
GitHub Actions Secret Rotation:
- List all repositories in your organization using the GitHub CLI:
gh repo list --limit 1000 --json name --jq '.[].name'
- For each repository, manually review and update secrets and variables in the GitHub UI (
Settings > Secrets and variables > Actions). There is no bulk rotation API, so this must be done per repo. - For Infrastructure-as-Code (IaC) secrets (e.g., in Terraform/Truffle), locate all `.tfvars` or `truffle-config.js` files and rotate API keys, cloud credentials, and database passwords.
-
Victimology: Why CI/CD Systems Are the Primary Target
A striking 75% of impacted workloads were CI/CD systems, with only 25% being user machines. CI/CD servers are treasure troves: they have broad permissions, store secrets in environment variables, and often have network access to production environments.
Step-by-step guide explaining what this does and how to use it.
Harden your CI/CD runners (e.g., GitHub Actions, GitLab CI, Jenkins) immediately.
GitHub Actions Hardening:
Example secure workflow. Use explicit commit SHAs, not branches.
jobs:
build:
runs-on: ubuntu-latest
permissions: Implement least-privilege permissions
contents: read
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.sha }} Pin to specific SHA
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci --audit --ignore-scripts Use `npm ci` and ignore post-install scripts
Jenkins Hardening (Scripted Pipeline):
pipeline {
agent any
options {
disableConcurrentBuilds()
timeout(time: 30, unit: 'MINUTES')
}
environment {
// Secrets should be injected via Jenkins Credentials Store, never hardcoded.
AWS_CREDENTIALS = credentials('aws-prod-cred')
}
stages {
stage('Build') {
steps {
sh 'npm ci --ignore-scripts' // Critical flag to prevent malicious post-install scripts
sh 'npm audit --audit-level=high'
}
}
}
}
4. Containment and Eradication: Isolating the Worm
The worm’s self-replicating nature means simple package removal is insufficient. You must inspect and clean version control history, as the worm may have committed malicious code or secrets to your git repositories.
Step-by-step guide explaining what this does and how to use it.
Scan your git history for indicators of compromise (IOCs) and secrets.
1. Search entire git history for references to the malicious packages
git log --all --oneline | xargs -I {} git show {} | grep -l "tunnel-agent|asyncapi" | head -20
<ol>
<li>Use truffleHog or git-secrets to find committed secrets
Install truffleHog
python3 -m pip install truffleHog
Scan a git repository
trufflehog git --since-commit HEAD~100 --regex --entropy=False https://github.com/your/repo.git</p></li>
<li><p>Consider using the BFG Repo-Cleaner to purge sensitive data from history if found.
WARNING: This rewrites history.
java -jar bfg.jar --delete-files 'truffleSecrets.json' your-repo.git
5. Proactive Defense: Implementing Supply Chain Security Controls
Prevention requires shifting left and integrating security into the software development lifecycle (SDLC). This involves enforcing policies on dependencies and build pipelines.
Step-by-step guide explaining what this does and how to use it.
Implement automated dependency and pipeline scanning.
Using GitHub Advanced Security / Dependabot:
- Enable Dependabot alerts and security updates in your GitHub repository settings.
2. Create a `.github/dependabot.yml` file:
version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "daily" ignore: - dependency-name: "lodash" Example, ignore specific packages if needed
Integrating Static Application Security Testing (SAST) and Software Composition Analysis (SCA):
Example using OWASP Dependency-Check in a CI pipeline docker run --rm -v $(pwd):/src owasp/dependency-check:latest \ --scan /src \ --format HTML \ --out /src/reports/ The report will detail known vulnerabilities in your dependencies (CVE).
What Undercode Say:
- The Attackers Are Playing the Long Game: Shai-Hulud 2.0 isn’t just a smash-and-grab; it’s a sophisticated, data-gathering operation designed to map and exploit the interconnectedness of modern development ecosystems. The low validation rate of stolen secrets suggests they are casting a wide net, intending to sift through the data later for persistent access.
- CI/CD is the New Battlefield: The 75/25 split between CI/CD systems and user machines is a clarion call. Securing the build pipeline is no longer optional—it is the single most critical defensive perimeter. Attackers logically target the component with the highest permissions and the greatest potential for lateral movement.
Prediction:
The credential trove harvested in this attack will fuel the next wave of targeted intrusions for months, if not years, to come. We predict a two-pronged future impact: First, immediate follow-on attacks using the validated, long-lived credentials (like cloud access keys) for cryptomining, data theft, and ransomware. Second, more sophisticated, tailored supply chain attacks leveraging the intimate understanding of internal development workflows gleaned from this data. The attackers have essentially obtained a blueprint of their victims’ software factories, enabling them to craft subsequent payloads that are far more evasive and damaging. Organizations that delay comprehensive secret rotation and CI/CD hardening will become the low-hanging fruit in this inevitable second act.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ramimac Were – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
