慢雾发布npm供应链攻击警报：23个包受影响，408个GitHub仓库凭证遭窃
Related
SlowMist issues npm supply chain attack alert: 23 packages affected, 408 GitHub repository credentials stolen.
PANews reported on June 25th that the SlowMist security team issued an alert stating that a new variant of the Shai-Hulud/Miasma/Hades npm malware is affecting the npm ecosystem. This variant is associated with the compromised npm developer account czirker. The attack campaign utilizes a pre-configured file (binding.gyp) to execute malicious code during the npm install process. Currently, 23 affected packages have been confirmed, with leo-logger experiencing 3,140 downloads in a single week. As of the alert's issuance, 408 affected GitHub repositories containing stolen credentials have been detected.
SlowMist: A new malware variant has emerged in the npm ecosystem, affecting 408 GitHub repositories.
According to Foresight News , the SlowMist security team has issued an alert regarding a new variant of the Shai-Hulud/Miasma/Hades malware linked to the compromised developer account czirker within the npm ecosystem. This attack campaign triggers malicious code during the `npm install` process via a pre-configured file containing the string `binding.gyp`. A total of 23 packages have been confirmed to be affected, with leo-logger experiencing a staggering 3140 downloads per week. As of the time of this report, 408 compromised GitHub repositories containing the stolen credentials have been discovered. Potential attack behaviors include GitHub token theft, npm token theft, AWS/GCP/Azure cloud credential theft, on-premises data breaches, malicious abuse of GitHub Actions workflows, and further proliferation through the npm supply chain. SlowMist recommends that security teams immediately review locked files and package history, downgrade or remove affected packages, and rotate npm, GitHub, cloud services, CI/CD, and application keys, while also enforcing two-factor authentication (2FA).
Shai-Hulud Hades' new variant attack on PyPI exploits cross-runtime chaining from Python to Bundle to steal credentials.
According to Mars Finance, SlowMist has discovered a new variant of the Shai-Hulud Hades attacking PyPI. The malicious package delivers a .pth file, executes automatically upon Python startup, and checks if the Bundle is installed locally. If not, it downloads the official Bundle binary from GitHub Releases and executes a multi-layered obfuscated JavaScript payload to steal GitHub, npm, AWS, and other cloud service credentials. SlowMist states that this variant uses the same RSA public key and infrastructure as the previous Shai-Hulud attack and possesses capabilities such as encrypted transmission, persistence, CI/CD injection, and GitHub Actions injection.
More than 70 Microsoft open-source libraries were infected by the Miasma worm, and the worm was part of the same group that emptied GitHub in May.
According to Beating's monitoring, over 70 open-source code repositories hosted by Microsoft on GitHub were urgently shut down due to a Miasma worm attack. The infected repositories primarily included Azure Functions host processes and open-source versions of the Durable Task orchestration framework in multiple languages, including .NET, Java, Go, and JavaScript. This attack on Microsoft is linked to the internal GitHub code theft in mid-May. At that time, the hacker group TeamPCP released an infected VS Code extension on the Microsoft Store. A GitHub employee downloaded and became infected during the brief 11-minute upload window, resulting in the theft of all credentials and keys from their computer. The hackers used these credentials to bypass the security network and steal approximately 3,800 internal GitHub repositories. After the success, TeamPCP publicly released and open-sourced the self-replicating worm framework Mini Shai-Hulud on their forums. The Miasma worm that infiltrated Microsoft is a variant and upgraded version of Mini Shai-Hulud. The Miasma worm's operating mechanism is specifically designed for AI programming scenarios. Hackers use previously stolen Microsoft contributor tokens to inject malicious code into trusted official repositories. Developers only need to open or analyze these infected projects in AI assistants such as Claude Code, Cursor, or Gemini CLI, and the programming assistant will automatically trigger the malicious payload when parsing the configuration file. Once activated, the worm scans disks in the background, stealing AWS, GCP, and Azure cloud credentials, as well as SSH keys, npm/PyPI tokens, and Kubernetes keys from the developer's computer. It then uses the newly acquired credentials to find the next GitHub repository to infect, achieving automated self-replication. This is the second time in a few weeks that the Microsoft Durable Task open-source project has been compromised (it was previously injected with a malicious Python dependency package at the end of May). In response to the malicious commit in early June, GitHub's automated defense system reacted extremely quickly, automatically shutting down 73 infected repositories within 105 seconds of the code submission, successfully stopping the worm's spread. Microsoft has notified a small number of developers who pulled the compromised code to begin emergency credential rotation and to gradually restore the affected repositories following a security audit. Security agencies warn that as supply chain attacks evolve into automated worms targeting AI agent workflows, developers must carefully assess the risks of running unknown repositories directly within AI assistants.
Security Alert: Red Hat Cloud Services npm packages are under attack by an active supply chain; stolen credentials found in over 300 GitHub repositories.
According to Mars Finance, on June 2nd, SlowMist issued a security alert detecting an active npm supply chain attack targeting packages related to @redhat-cloud-services. Currently, over 31 packages have been confirmed affected, with approximately 116,000 downloads per week, and stolen credentials found in over 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leaks. New suspicious repositories continue to emerge, indicating the attack is ongoing and developers are still being infected. Potential harms include: stolen GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, secret collection of SSH keys and Kubernetes data, leakage of local environment and wallet data, malicious repository creation and persistence operations, and even potentially destructive behavior after token revocation. It is recommended to immediately remove or downgrade the affected @redhat-cloud-services package version, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH and wallet-related keys, retain logs, and rebuild exposed developer machines or runners from clean images, while remaining highly vigilant.
SlowMist: A new supply chain attack has emerged on PyPI, capable of stealing developers' cloud credentials such as GitHub and AWS.
According to Foresight News , the SlowMist security team has disclosed a variant of the Shai-Hulud Hades attack affecting the PyPI ecosystem, involving malicious packages openai_mcp-2.41.2 and bramin-0.0.4. These two malicious packages are automatically triggered when the Python interpreter starts via .pth files. They silently download the Bun runtime and then execute a multi-layered obfuscated JavaScript payload, capable of stealing cloud credentials such as GitHub PAT, npm, and AWS, encrypted transmission (RSA-OAEP), persistent persistence, and CI/CD injection. Furthermore, they embed content related to weapons of mass destruction before the malicious code to interfere with AI security scanning. SlowMist confirmed that this attack shares the same RSA public key and infrastructure as the previous Red Hat Cloud Services npm poisoning incident.