flawopen.com/घटनाएं (Incidents)/Shai-Hulud npm worm

Shai-Hulud: npm इकोसिस्टम का वह साइबर वर्म जो बिना इंसानी मदद के खुद को पब्लिश करता गया

Defences that would have mattered

• ✓Disable install scripts by default in CI. npm ci --ignore-scripts neutralises the execution primitive this worm depended on. Allowlist the small number of dependencies that truly need a native build step.
• ✓Pin with a lockfile and use npm ci, not npm install. A lockfile means a freshly published malicious version is not silently pulled into your build the hour it appears.
• ✓Stop using long-lived publish tokens. Trusted publishing / OIDC-based workflows mean there is no static token sitting in an environment variable for a scanner to find. This attacks the propagation step directly.
• ✓Require phishing-resistant MFA for maintainer accounts. The initial compromise was credential phishing. Hardware-backed WebAuthn does not forward to a lookalike domain the way a typed OTP does.
• ✓Scope CI credentials down and give them short lives. Assume a build runner will eventually execute hostile code, and size the credentials it holds accordingly.
• ✓Add a cooldown on new versions. Refusing to auto-adopt releases published in the last 24–72 hours costs little and removes you from the window in which these campaigns do their damage.

The transferable lesson

Most dependency-security tooling is built to answer "does this package have a known CVE?". A freshly trojanised version of a package you already trust has no CVE, a legitimate history, and a maintainer in good standing. Shai-Hulud is the argument for treating installation itself as the security boundary — controlling what executes, what credentials are within reach when it does, and how quickly new versions are adopted — rather than relying on after-the-fact vulnerability lists.

FAQ

स्रोत और आधिकारिक एडवाइजरी

• Unit 42 (Palo Alto Networks) — "Shai-Hulud" worm compromises npm ecosystem in supply chain attack
• Checkmarx — npm hit by Shai-Hulud, the self-replicating supply chain attack
• Trend Micro — what we know about the npm supply chain attack
• Panther — Shai-Hulud npm supply chain attack: what to know
• npm docs — npm ci
• npm docs — the ignore-scripts configuration option
• CWE-506 — Embedded Malicious Code