New npm Supply Chain Attack Identified

THE THREAT

On September 16th, 2025, a large-scale attack against npm was discovered, affecting 187 packages including several from CrowdStrike. The attack, attributed to the same threat actors behind the August 27th Nx attack, deployed a worm named "Shai Hulud" that automatically steals and publicly publishes secrets to GitHub, runs trufflehog to gather secrets, creates GitHub actions for data exfiltration through webhook sites, and makes private repositories public.

In response to the incident, CrowdStrike has confirmed the identification of malicious packages in the public NPM registry and has taken immediate remediation steps, including package removal and key rotation. The company has emphasized that their Falcon sensor and platform remain unaffected, and customer protection remains intact. They are currently collaborating with NPM for a thorough investigation of the incident.

eSentire has performed a thorough investigation and confirmed we do not have internal risk from any known malicious Node Package Manager (NPM) packages relating to this incident. There is no impact to our service delivery or customer protection. With any worm attack this is an ongoing and dynamic scenario, and we will continue to remain on high alert. We are proactively threat hunting and sweeping across our customer environments with eSentire Agent and exploring additional threat detection content builds across our customer base. We proactively recommend rotating all potentially compromised credentials, including npm tokens and GitHub access tokens. Organizations that rely on the impacted npm packages face the risk of data theft and follow on attacks, as such, rapid remediation is critical.

What we’re doing about it

• Threat Hunts for known Indicators of Compromise (IoCs), via eSentire MDR for Endpoint and MDR for Log, are ongoing
• eSentire has rotated relevant user credentials out of an abundance of caution
• eSentire Threat Intelligence team is tracking this topic for additional details and detection opportunities

What you should do about it

• Organizations are advised to implement a comprehensive remediation plan including immediate package audits, credential rotation, and enhanced security controls
  • Immediately removing and replacing all affected packages, specifically check the project’s lockfile (package-lock.json)
    • rm -rf node_modules && npm cache clean --force
  • Conducting full security audits of CI/CD pipelines and development environments
    • Remove any malicious packages and rebuild the project with clean dependencies both locally and on the CI/CD production server
  • Implementing strict version pinning and package lockfiles
  • Rotating all potentially compromised credentials
    • GitHub tokens, npm tokens, SSH keys, API keys, and environment variable secrets
  • Implementing automated security controls such as package signing, mandatory code review processes, and continuous dependency scanning
  • Run tools like npm audit, Snyk, or other Software Composition Analysis (SCA) tools
  • Issue an invalidation command for all affected JavaScript assets on their Content Delivery Network (CDN) to force servers to discard the cached malicious files
  • Follow OWASP npm Security Best Practices in the software development life cycle
  • Integrate GitHub logs into SIEM (MDR for Log) for enhanced monitoring

Additional information

The npm ecosystem has experienced a series of significant supply chain attacks in recent months, demonstrating an alarming trend in sophisticated attack methodologies. Following the Nx attack on August 27th and the Debug/Chalk package compromises on September 8th, and the most recent incident affecting CrowdStrike's npm packages highlights that even security-focused organizations are not immune to these threats. While the initial attack vector targeting CrowdStrike's packages remains undisclosed, the attackers demonstrated sophisticated capabilities by leveraging security tools like TruffleHog for credential harvesting and implementing advanced self-propagation mechanisms.

The threat actors deployed an advanced self-propagating malware dubbed "Shai Hulud," which demonstrated significant evolution from their previous Nx attack. The malware's sophisticated infection mechanism utilized automated package compromise through npm registry, affecting critical CrowdStrike components including @crowdstrike/commitlint (8.1.1, 8.1.2) and @crowdstrike/falcon-shoelace (0.4.1, 0.4.2). It incorporated self-propagation via modified package.json files, malicious postinstall hook injection, and automatic version number incrementation. Its data exfiltration capabilities were extensive, including environment variable harvesting (process.env), cloud service credential extraction from AWS and GCP metadata endpoints, and integration with TruffleHog for secret detection. The malware employed dual exfiltration channels, creating dedicated GitHub repositories and implementing GitHub Actions workflows with webhook endpoints, while encoding sensitive data in GitHub Actions logs.

The eSentire Threat Intelligence team assesses that threat actors will continue to carry out supply chain attacks by targeting npm developers. Organizations are advised to implement a comprehensive remediation plan including immediate package audits, credential rotation, and enhanced security controls. Critical steps include: 1) Immediately removing and replacing all affected packages, 2) Conducting full security audits of CI/CD pipelines and development environments, 3) Implementing strict version pinning and package lockfiles, and 4) Rotating all potentially compromised credentials, including npm tokens and GitHub access tokens. Additionally, organizations should consider implementing automated security controls such as package signing, mandatory code review processes, and continuous dependency scanning. For long-term protection, organizations should follow OWASP Software Component Verification Standard (SCVS) and implement robust Software Bill of Materials (SBOM) tracking to maintain visibility into their software supply chain dependencies.

References:

[1] https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again
[2] https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
[3] https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised
[4] https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
[5] https://www.wiz.io/blog/s1ngularity-supply-chain-attack
[6] https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html
[7] https://supportportal.crowdstrike.com/s/article/Tech-Alert-NPM-packages-in-Public-Registries
[8] https://www.reddit.com/r/crowdstrike/comments/1nigwjp/comment/neixlcg/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
[9] https://www.cisa.gov/sbom
[10] https://owasp.org/www-project-software-component-verification-standard/