flawopen.com/보안 사고/Shai-Hulud npm worm

Shai-Hulud: 사람의 개입 없이 스스로 새 버전을 빌드하고 배포한 npm 공급망 웜

Critical — Ecosystem-wide CWE-506: Embedded Malicious Code September 2025
쉬운 설명 (ELI5)

부품을 서로 납품받아 조립하는 공장들이 있습니다. 누군가 관리자 출입증을 훔쳐 함정이 든 상자를 보냈습니다. 다음 공장에서 상자를 여는 순간, 함정이 그 공장의 출입증까지 복제하여 스스로 새 함정 상자를 만들어 다른 공장들로 보냅니다. 조종자가 없어도 혼자서 기하급수적으로 퍼져나갑니다.

Defences that would have mattered

The transferable lesson

Most dependency-security tooling is built to answer "does this package have a known CVE?". A freshly trojanised version of a package you already trust has no CVE, a legitimate history, and a maintainer in good standing. Shai-Hulud is the argument for treating installation itself as the security boundary — controlling what executes, what credentials are within reach when it does, and how quickly new versions are adopted — rather than relying on after-the-fact vulnerability lists.

FAQ

How do I tell whether I was affected?

Check whether any affected package version appears in your lockfiles or CI logs for the exposure window, look for unexpected public repositories or new Actions workflows on developer and organisation GitHub accounts, and audit npm and GitHub token creation and package publication events. If a build machine ran an affected version, treat every credential that machine could reach as compromised and rotate it.

Does --ignore-scripts fully protect me?

It removes the install-time execution path, which is what this worm used. It does not protect you from malicious code inside a package you actually import and run. It is a strong control, not a complete one.

Was this a one-off?

No. Further variants using the same self-propagating pattern were reported in late 2025 and into 2026, and the technique has since been observed spanning multiple registries. The structural weaknesses it exploits — automatic script execution and long-lived publish tokens — are properties of the ecosystem rather than of any one package.

출처 및 공식 보안 권고