sigh.... Kinda getting sick of writing these, absolutely insane the pace of supply chain attacks anyway...
The same ThreatActors behind the NX S1ngularity attack have launched a self-replicating worm, it's infected 187 packages and its terrifying.

Yesterday a software developer Daniel Pereira noticed a weird repo being created.... when he looked into it he was the first to realize that actually tinycolor was infected with malware. He reached out to multiple people, no one took him seriously until he reached out to Socket who discovered that 40 packages were compromised.

Fun story, a little concerning but honestly this happens a lot so it's not crazy.... But then it got worse, so much worse.

When I woke up, our lead researcher Charlie Erikson had discovered that actually a total of 187 packages were compromised (147 more than Socket had reported) 20 of which were from Crowdstrike.

What does the worm do

• Harvest: scans the host and CI environment for secrets — process.env, scanning with TruffleHog, and cloud metadata endpoints (AWS/GCP) that return instance/service credentials.
• Exfiltrate (1) — GitHub repo: creates a repo named Shai-Hulud under the compromised account and commits a JSON dump containing system info, environment variables, and collected secrets.
• Exfiltrate (2) — GitHub Actions → webhook: drops a workflow .github/workflows/shai-hulud-workflow.yml that serializes ${{ toJSON(secrets) }}, POSTs them to an attacker webhook[.]site URL and writes a double-base64 copy into the Actions logs.
• Propagate: uses any valid npm tokens it finds to enumerate and attempt to update packages the compromised maintainer controls (supply-chain propagation).
• Amplify: iterates the victim’s accessible repositories, making them public or adding the workflow/branch that will trigger further runs and leaks.

Its already turned 700 previously private repositories public This number will go down as they are removed by maintainers

if you remeber the S1ngularity breach this is the exact same type of attacker and 100% the same attackers.

The questions I have from that attack remain.... I have no idea why they are exfiltrating secrets to Public GitHub repos and not a private C2 servers (other than to cause chaos)

The malicious versions have since been removed by Crowdstrikes account. Here is a total list of the packages compromised and their versions