According to cybersecurity researchers, there is an ongoing “Shai-Hulud-like” supply chain worm campaign that has used a group of at least 19 malicious npm packages to facilitate cryptocurrency key theft and credential harvesting.
The supply chain security firm Socket has given the campaign the code name SANDWORM_MODE. Similar to previous Shai-Hulud attack waves, the malicious code included in the packages has the ability to access tokens, environment secrets, and API keys from developer environments, syphon off system information, and automatically spread by abusing GitHub and npm identities to increase its reach.
In addition to adding GitHub API exfiltration with DNS fallback, hook-based persistence, SSH propagation fallback, MCP server injection with embedded prompt injection targeting AI coding assistants, and LLM API, the sample keeps the characteristics of Shai-Hulud read more about Malicious npm Packages Harvest Crypto Keys CI Secrets and API Tokens.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.