Overview of the Attack

The attack was initially identified by LinkedIn user Daniel Pereira, who shared details in a post on 15 September 2025 at 10:30 PM UTC. He reported detecting malware in @ctrl/tinycolor@4.1.1 and advised against installing any additional packages from the maintainer scttcper, on concerns of further compromise.

Later a list of confirmed compromised packages were identified:

How the Attack Worked

When a victim installs any of the above infected packages, a post-install script triggers and calls the function “NpmModule.updatePackage”, the script then is tasked with compromising further packages by the same maintainer, by the help of the above function, it modifies package.json, then creates a file called bundle.js and republishes the package. In this way, the entire ecosystem can be affected with no human efforts.

After the victim is done installing an affected version, the post install script runs bundle.js from the command “node bundle.js”. This specific script tries to download TruffleHog based on the victim’s OS(Linux/Windows), a secret searching tool to find exposed sensitive credentials across the machine. Upon running the TruffleHog tool, a list of secrets such as GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY are exfiltrated, a notable point is that, the found NPM, GitHub tokens are validated by using NPM’s whoami endpoint and GitHub’s API, so that only authenticated working tokens are sent.

The exfiltrated credentials are then posted to a webhook site: “webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7”

Webhook.site is a free service that is used to instantly receive, inspect, and debug HTTP requests without setting up a server.

To increase attack’s persistence, the script then searches for the availability of GitHub PAT, if a GitHub Personal Access Token is found, a .github/workflows/shai-hulud-workflow.yml file is created to automate the CI/CD pipeline’s compromise, if this workflow is triggered, it wraps all the runner’s environment secret findings to a findings.json and then encodes it in base64, and sends it to webhook[.]site.

Impact

A supply chain attack at this scale with such complexity leads to rapid infection on a wide range of developer machines, the major impact is Credential Harvesting. The attack is able to exfiltrate:

1. NPM authentication tokens
2. GitHub personal access tokens
3. AWS access keys (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
4. Google Cloud Platform service credentials
5. Azure credentials
6. Cloud metadata endpoints

… and more secrets found by TruffleHog.

When a victim installs an infected package, it can not only exfiltrate all possible secrets from the machine but also act as a zombie to further infect more packages which the victim maintains on NPM Registry. This poses a serious risk for NPM Package maintainers.