🛡 New Supply Chain Attack: Worm Malware in npm Packages
A fast-moving worm is spreading across the npm ecosystem. At least 199+ packages—including tinycolor, @ctrl/tinycolor, and @crowdstrike/—now contain malicious code that exfiltrates API tokens, SSH keys, and cloud credentials, then self-replicates into other packages maintained by the same author.
⚠️ This is an ongoing incident: This supply chain attack is still unfolding. Our immediate priority is supporting customers with clear communication and actionable guidance. Apiiro’s data is continuously updated with the latest information from OSV (Open Source Vulnerabilities), ensuring that emerging indicators and advisories are reflected in your risk insights.
🛡 Apiiro Helps You Respond Quickly
- Detect malicious packages: In SCA → Risks, filter by the "Malicious package" insight and set the timeframe to discovered in the past 3 days. You can also search directly for specific packages such as tinycolor, @ctrl/tinycolor, and @crowdstrike/.
Discover your affected dependencies: Use Risk Graph Explorer to trace the full dependency tree and query any service or repo pulling compromised packages.
✅ Mitigation
- Remove and block compromised versions immediately
- Upgrade to clean releases as when available
- Rotate secrets, including API tokens, SSH keys, npm credentials, and cloud access keys, if exposure is suspected
- Clear your npm cache and reinstall only verified versions pinned by lockfiles.
🔍 Key indicators of compromise
- bundle.js SHA-256 hash family 46faab8a…f09
- .github/workflows/shai-hulud-workflow.yml
- Outbound traffic to webhook[.]site/*bb8ca5f6*
💡 Detect malicious code early with Apiiro’s open source tools
Apiiro offers proactive solutions to stop malicious payloads before production. The Malicious Code Ruleset secures any CI/CD stage, while the PRevent app blocks malicious commits from being added to your repositories. Explore the tools
