Shai-Hulud Migration Response

• Shai-Hulud Migration Response
  • Overview
  • Response Steps
  • Scanning for IoCs
    • Indicators of Compromise (IoCs)
    • Scanning for Malicious Package Versions
    • Scanning for Malicious Payloads
  • Credential Rotation
  • Setup Guardrails
  • References

This repository contains guidance and scripts for responding to the Shai-Hulud Supply Chain Attack on npm Packages.

If you are looking for guardrails against similar attacks, see:

1. vet for scanning your projects for malicious packages
2. vet-action for integrating vet into your GitHub workflows
3. pmg for preventing malicious package installation in developer machines

Overview

The Shai-Hulud supply chain attack started with compromise of multiple npm packages to distribute malware to developers. The malware was designed to steal credentials, source code and other sensitive information from infected systems. Technical details of the attack and the payload can be found in the SafeDep Incident Report.

Response Steps

If you believe you are affected by this attack, follow the steps below:

1. Scan your systems for indicators of compromise (IoCs) listed below
2. Rotate credentials available in compromised systems
3. Follow the guidance to harden against similar attacks in the future
4. Setup guardrails to protect against malicious open source packages
5. Harden your developer workflows to prevent npm based supply chain attacks

Scanning for IoCs

Indicators of Compromise (IoCs)

1. Malicious package versions data/ioc/malicious-package-versions.jsonl
2. Malicious payload hashes data/ioc/malicious-payload-hashes.jsonl

Scanning for Malicious Package Versions

vet is required to run this scan. Install vet using:

brew install safedep/tap/vet

Look at vet/README.md for other installation options.

Run a full file system scan using vet and create an sqlite3 database of all discovered package versions:

./scripts/pv-scan.sh

Note

Enrichment is explicitly disabled for this scan because malicious package versions are already known from the IOC list.

Tip

You can optionally set the WORKSPACE_DIR environment variable to specify a custom directory for storing scan results. If not set, /tmp will be used by default.

export WORKSPACE_DIR=/path/to/your/workspace
./scripts/pv-scan.sh

Run the query script to query the generated database for known malicious package versions:

./scripts/pv-query.sh

Scanning for Malicious Payloads

Warning

Scanning for payload hashes is compute intensive and may take a long time to complete.

Run the script to scan the file system for files matching known malicious payload hashes:

./scripts/pv-payload-hash-scan.sh

Optionally, you can specify a custom path to scan instead of the entire filesystem:

./scripts/pv-payload-hash-scan.sh /path/to/scan

Credential Rotation

The malicious payload delivered through the attack compromised credentials available in the infected systems. Rotate all known credentials, particularly the following:

• Npm credentials available in $HOME/.npmrc or $NPM_TOKEN environment variable
• GitHub credentials of developers using affected systems
• AWS credentials available in $HOME/.aws/credentials or $AWS_ACCESS_KEY_ID and $AWS_SECRET_ACCESS_KEY environment variables
• AWS credentials available in AWS Secrets Manager that were accessible from affected systems
• Google Cloud credentials and credentials stored in Google Cloud Secret Manager that were accessible from affected systems
• SSH private keys, especially if they were passwordless

The malicious payload also used TruffleHog to extract secrets from source code repositories available in the infected system. Consider running TruffleHog and rotating any secrets found in infected systems.

Setup Guardrails

• Install SafeDep vet or similar tools to scan open source packages for malicious code before merging pull requests or deploying code.
• Install SafeDep pmg or similar tools to prevent installation of malicious packages in developer machines.

References

• https://unit42.paloaltonetworks.com/npm-supply-chain-attack/
• https://safedep.io/npm-supply-chain-attack-targeting-maintainers/
• https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages