Shai-Hulud malware infects Red Hat npm packages downloaded 80K times weekly

Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week

TeamPCP? Or copycat malware dev?

Security researchers on Monday found dozens of Red Hat npm package releases infected with the Mini Shai-Hulud worm that TeamPCP cybercriminals recently open-sourced.

The new supply chain attack hit at least 32 npm package releases published under the Red Hat Cloud Services namespace, according to security researchers from Google-owned Wiz, who traced the malware to one Red Hat employee’s compromised GitHub account. They said the affected packages are downloaded around 80,000 times a week.

“The compromised account pushed malicious orphan commits to two RedHatInsights repositories, bypassing code review,” the threat hunters said in a Monday blog. “This happened across two waves of activity.”

Wiz considers this a “live threat,” and says its researchers are actively monitoring it for any new developments.

Socket, meanwhile, counted 95 affected package versionsas of 11:00:22...

Copyright of this story solely belongs to theregister.com. To see the full text click HERE