A sophisticated malware campaign dubbed “Shai Hulud v2” is actively exploiting GitHub Actions workflows to purloin sensitive secrets and compromise software supply chains. This new wave of attack has already infected at least 834 packages across the npm and Maven ecosystems, impacting prominent projects such as PostHog, Zapier, and AsyncAPI. The attackers are leveraging compromised automation tokens within GitHub Actions to systematically infect downstream dependencies, posing a significant threat to software development security.
The campaign’s success stems from its intricate two-stage infection process, initiated by a seemingly innocuous pre-install script. This script, named `setupbun.js`, installs the Bun runtime to execute an obfuscated payload, `bunenvironment.js`. A key element of its stealth is its ability to suppress standard output, making it challenging to detect within build logs during the initial compromise. Once inside a compromised CI pipeline, the malware gains elevated privileges, enabling it to alter source code, increment package versions, and then republish these infected packages to public registries.
Shai Hulud v2: A New Era of Supply Chain Exploitation
The “Shai Hulud v2” campaign represents a dangerous evolution in automated software supply chain attacks. According to security analysts at Socket.dev, the malware employs a unique persistence mechanism, using a distinctive beacon phrase: “Sha1-Hulud The Second Coming.” This phrase is used to actively search GitHub for instances of the malware, allowing attackers to re-initiate infections even if individual repositories have been cleaned. This persistent search ensures that vulnerable systems can be re-compromised, highlighting the persistent threat to the npm and Maven ecosystems.
The impact of this campaign is far-reaching, with evidence suggesting the exposure of sensitive credentials from tens of thousands of repositories. Once the malware establishes a foothold within a Continuous Integration (CI) environment, it initiates a comprehensive credential harvesting routine. It systematically captures all available environment variables, with a particular focus on tokens such as `GITHUB_TOKEN`, `NPM_TOKEN`, and `AWS_ACCESS_KEY_ID`. Concurrently, it deploys a TruffleHog binary to scour the local filesystem for any embedded secrets.
Beyond standard environment variable collection, this malware demonstrates an aggressive approach to data exfiltration. Unlike typical secret scrapers, the Shai Hulud v2 payload actively enumerates cloud infrastructure. It iterates through all regions in Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, seeking to extract secrets from managed cloud vaults. All the sensitive data collected is then obscured using three layers of Base64 encoding before being exfiltrated to a randomly generated GitHub repository, which is created within the victim’s own account.
The attackers are also employing techniques to escalate privileges. On Linux runners, the malware attempts to gain root access by manipulating sudoers files or by executing privileged Docker commands. In scenarios where no valid credentials are found to facilitate the propagation of the worm-like behavior, the malware resorts to a destructive wiper function, executing commands to delete files on the compromised system. This multifaceted approach, combining stealthy initial compromise with aggressive credential harvesting and potential destruction, underscores the severity of the Shai Hulud v2 threat to the software supply chain.
The findings by Socket.dev highlight the ongoing challenges in securing the software supply chain against increasingly sophisticated threats. The continuous monitoring of dependencies and CI/CD pipelines, along with robust access control and secret management practices, becomes paramount in mitigating the risks posed by campaigns like Shai Hulud v2. The security community will likely focus on developing more advanced detection mechanisms and response strategies to counter such evolving attack vectors that target the foundational elements of modern software development.