Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens
According to cybersecurity researchers, there is an ongoing "Shai-Hulud-like" supply chain worm campaign that has used a group of at least 19 malicious npm packages to facilitate cryptocurrency key theft and credential harvesting.
The supply chain security firm Socket has given the campaign the code name SANDWORM_MODE. Similar to previous Shai-Hulud attack waves, the malicious code included in the packages has the ability to access tokens, environment secrets, and API keys from developer environments, syphon off system information, and automatically spread by abusing GitHub and npm identities to increase its reach.
In addition to adding GitHub API exfiltration with DNS fallback, hook-based persistence, SSH propagation fallback, MCP server injection with embedded prompt injection tar...