Elastic Security Labs has detected the return of the Shai-Hulud threat actor, who compromised the keyv package maintainer to deploy the CHAINDROP worm across 400+ npm packages. The worm leverages stolen npm credentials to inject backdoors into co-owned packages that collectively receive over 1.3 billion monthly downloads, creating significant supply-chain risk across the JavaScript ecosystem.
Read full article at Elastic Security Labs ↗Attackers are increasingly focusing on CI/CD pipelines and developer tools rather than application code itself, exploiting gaps in the software development lifecycle supply chain. Organizations need comprehensive visibility across their entire SDLC and implement rigorous security controls to defend these overlooked but critical infrastructure components.
Researchers discovered 14 malicious npm packages disguised as calendar and streak utilities that deliver RedC2 4.0, an AI-powered Linux backdoor to infected systems. Upon installation, the trojanized packages extract and execute a bundled binary as a background process to establish command and control. This supply chain attack demonstrates how legitimate package repositories remain a vector for distributing sophisticated implants with AI-assisted capabilities.
The bank said there is no evidence that its own systems, networks or data repositories were compromised.
Attackers have compromised popular Rust package repositories by injecting malicious code into legitimate crates, transforming standard build processes into vehicles for distributing infostealer malware. The poisoned packages targeted developer credentials, leveraging the trust developers place in established Rust dependencies to compromise their systems and sensitive authentication data.