170 npm Packages Hijacked to Steal GitHub, AWS & Kubernetes Secrets

Hackers have launched a large-scale supply chain attack by compromising more than 170 npm packages and two PyPI libraries, collectively downloaded over 200 million times weekly, to steal sensitive developer and cloud credentials.

The malicious npm packages contain a hidden preinstall script that silently executes during installation. This script deploys a loader, which downloads a runtime environment and launches a heavily obfuscated JavaScript payload inside developer machines and CI/CD pipelines.

Unlike typical credential stealers, this malware does not stop at data theft. It actively searches for npm publishing tokens, modifies legitimate package code, injects malicious components, and republishes infected versions.

This allows it to spread recursively, turning compromised environments into propagation points.

Security researchers at JFrog have linked the campaign to the resurfacing “Shai-Hulud” malware, which is now exhibiting worm-like behavior and spreading autonomously across development ecosystems.

The PyPI variant follows a different approach. It embeds a downloader inside the package import process, which fetches a remote Python payload from attacker-controlled infrastructure.

Researchers confirmed that this payload has evolved into a full-featured credential stealer targeting cloud platforms, local systems, and developer tools.

170 npm Packages Hijacked

The intrusion began inside a trusted GitHub Actions release workflow. Attackers exploited a misconfiguration that allowed untrusted forked code to execute within a privileged environment.

One layer uses PBKDF2-SHA256 with the campaign salt svksjrhjkcejg, then derives stream keys from per-string IVs.

As a result, malicious packages were published using legitimate credentials and trusted publishing pipelines. This makes detection significantly harder, as the packages appear authentic despite containing malware.

Once inside the CI/CD environment, the malware extracts sensitive GitHub Actions tokens and OIDC identity data directly from runner memory. These tokens are then exchanged for npm publishing access, allowing attackers to push compromised packages at scale.

The payload is designed to extract a wide range of secrets from infected systems, including:

• GitHub tokens and Actions secrets.
• npm publishing credentials.
• AWS credentials from environment variables, files, and instance metadata.
• Kubernetes service account tokens and cluster secrets.
• HashiCorp Vault tokens.
• Local developer data such as SSH keys, .npmrc files, shell history, and API keys.

In cloud environments, the malware actively queries AWS EC2 metadata services and Kubernetes APIs to expand its reach. It can also enumerate secrets across namespaces and extract sensitive configurations.

To avoid detection, the malware uses multiple layers of obfuscation, including encrypted payloads and runtime decryption using PBKDF2 and AES-256. This makes static analysis difficult and allows the core functionality to remain hidden.

Stolen data is exfiltrated through several redundant channels:

• Encrypted uploads to attacker-controlled servers.
• GitHub repositories created using stolen tokens.
• GitHub commits with hidden data payloads.
• Decentralized Session/Oxen network endpoints.

One notable indicator is the use of commits authored by “claude@users.noreply.github.com,” which defenders can use for threat hunting.

A particularly dangerous feature is a “dead-man switch.” The malware installs a persistent background service that monitors stolen GitHub tokens. If a token is revoked, the malware may trigger destructive actions such as wiping the user’s system.

This forces defenders to carefully remove persistence mechanisms before revoking credentials, complicating incident response.

The updated Python payload expands the attack further. It steals credentials from AWS, GCP, Azure, Kubernetes, Vault, and even password managers like 1Password and Bitwarden.

In some cases, it can deploy a second-stage payload disguised as a system service. This stage includes a destructive routine that can delete entire Linux systems under specific conditions, highlighting the campaign’s escalation.

This campaign demonstrates how modern supply chain attacks can bypass trust mechanisms and spread like worms across ecosystems. Even packages built through verified pipelines can be malicious if attackers compromise the build process itself.

JFrog confirmed that its security solutions detected and blocked all malicious packages within 24 hours, but the incident underscores the need for stricter CI/CD controls, runtime monitoring, and credential hygiene across development environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.