JavaScript Supply Chain Attack Compromises Crypto Software Packages
According to Cointelegraph, a significant JavaScript supply chain attack has compromised hundreds of software packages, including at least ten widely used within the cryptocurrency ecosystem. This revelation comes from new research conducted by cybersecurity firm Aikido Security. Charlie Eriksen, a researcher at Aikido Security, disclosed in a Monday post that over 400 packages show signs of infection with the 'Shai Hulud' self-replicating malware, which is part of an ongoing JavaScript NPM library supply chain attack. Eriksen emphasized that each detection was validated to avoid false positives. Many of the affected cryptocurrency-related packages receive tens of thousands of downloads weekly and are essential for the functioning of numerous other packages. In a post on X earlier today, Eriksen also alerted the Ethereum Name Service (ENS) team about the impact on several of their packages.
The Shai Hulud malware is part of a broader trend of supply chain attacks. In early September, the largest NPM attack reported to date resulted in hackers stealing $50 million worth of cryptocurrency. Amazon Web Services noted that this initial attack was succeeded by the autonomous spread of the Shai Hulud worm just a week later. Unlike the previous attack, which directly targeted cryptocurrency assets, Shai Hulud is a general-purpose credential-stealing malware that spreads autonomously across developer infrastructure. If the infected environment contains wallet keys, the malware will steal them as 'secrets,' similar to any other credential.
Among the affected packages, at least ten are specifically related to the cryptocurrency industry, with nearly all linked to the ENS, a human-readable address name service. Notable affected packages include ENS's content-hash, with almost 36,000 weekly downloads, and address-encoder, with over 37,500 weekly downloads. Other impacted ENS packages are ensjs, ens-validation, ethereum-ens, and ens-contracts. Additionally, a cryptocurrency-related package unrelated to ENS, called crypto-addr-codec, was compromised, with nearly 35,000 downloads.
Non-crypto-related packages have also been affected, including some offered by the corporate automation platform Zapier, with one package receiving over 40,000 downloads per week. Eriksen highlighted other infected packages, some with nearly 70,000 weekly downloads, and another with well over 1.5 million weekly downloads. Eriksen described the scope of the Shai Hulud attack as 'massive,' noting ongoing efforts to confirm the full extent of the impact. Researchers at cybersecurity firm Wiz reported spotting over 25,000 affected repositories across approximately 350 unique users, with 1,000 new repositories being added consistently every 30 minutes. The company advises immediate investigation and remediation for any environment using npm.
