Compromised npm packages steal developer and CI/CD secrets

Researchers at Aikido and Socket have identified a new Mini Shai-Hulud-style supply chain campaign, with a payload dubbed Miasma, affecting npm packages under the @redhat-cloud-services namespace. According to the reporting, 96 versions across 32 packages were compromised. The malicious packages used a preinstall script to execute an obfuscated payload during installation, before the package was ever imported or used. The payload harvests developer and CI/CD secrets, including GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys and Git credentials.

What this means for your organisation

Because the code runs at install time, a single build on a build agent is enough. Build environments often hold broader access than developer laptops, and secrets leaking from there can give an attacker a foothold in cloud, repositories and production. It is a reminder that dependencies from familiar, seemingly credible namespaces cannot be treated as trusted without verification.

Berigo recommends

• Review build logs for the period and look for installation of affected packages.
• Rotate tokens, cloud keys and SSH keys that have been exposed in the build environment.
• Disable install script execution in the build chain where possible, and use lock files.
• Give build agents short-lived, least-privilege secrets rather than long-lived tokens.

Source

• socket.dev
• aikido.dev