Massive supply chain attack hits ctrl/tinycolor

A sophisticated and widespread supply chain attack has hit the NPM ecosystem, compromising the popular ctrl/tinycolor package, which is downloaded over 2 million times a week.

See also: Attack on npm supply chain with minimal profits for hackers

The attack also affected more than 40 other packages from various maintainers, introducing a dangerous self-replicating malware designed to steal credentials and spread itself across software. The incident came to light when users discovered suspicious activity on GitHub and immediately alerted the open source community.

The malicious versions, identified as 4.1.1 and 4.1.2 of ctrl/tinycolor, were quickly removed from the NPM registry, but not before they were distributed. Security analysts from StepSecurity later provided a detailed technical analysis of the attack, confirming its severity and unique method of propagation.

What sets this attack, which affects ctrl/tinycolor, apart, is its automated, worm-like behavior. The malware contains a “self-replication engine” that actively seeks out and infects other software packages. Once a developer’s machine is compromised, the malware uses a function called NpmModule.updatePackage to inject its malicious code into other projects maintained by the same author. This creates a cascade effect, allowing the threat to spread rapidly through the interconnected web of software dependencies without further manual intervention by the attackers.

See also: Wealthsimple: Supply chain attack led to data breach

The malware's primary goal is aggressive credential harvesting. The attackers repurposed a legitimate secrets scanning tool, TruffleHog, to search for sensitive information on compromised systems. It specifically targets a wide range of valuable secrets, including:

– NPM authentication credentials
– GitHub personal access credentials
– Amazon Web Services (AWS) access keys
– Google Cloud Platform (GCP) service credentials
– Microsoft Azure credentials

To ensure its persistence, the malware creates a malicious GitHub Actions named .github/workflows/shai-hulud-workflow.yml.

This file allows attackers to maintain access to compromised repositories, potentially reinfecting them or extracting more data over time. All of the stolen data was piped to a publicly exposed location on the webhook.site service.

In response to this critical threat, security experts are urging developers and organizations to take immediate action. The first step is to check all projects for the presence of compromised packages and their malicious versions. If found, they should be removed or downgraded to a safe version immediately.

Given the malware's extensive credential stealing capabilities, it is critical to rotate all potentially exposed secrets. This includes NPM credentials, GitHub access credentials, and any cloud provider credentials (AWS, Azure, GCP) that may have existed in development or CI/CD systems.

See also: Over 6,700 private repositories exposed in Nx attack

Finally, a full infrastructure audit is recommended. Developers should scan their repositories for the malicious shai-hulud-workflow.yml, review recent NPM publish activity for any unauthorized package releases, and monitor outbound network traffic for any connections to the known export point.