Happy Birthday, Shai-Hulud
Brief
This week marks one year since an attacker pushed a malicious version of @ctrl/tinycolor to npm, kicking off the worst year for npm security on record. At the time, the package was downloaded more than two million times a week. Within a day the same code was spreading on its own across dozens of packages, and then into CrowdStrike's npm namespace .
It was the first known self-propagating worm in the npm ecosystem, and it has not really stopped since.
The tinycolor compromise put software supply chain security on everyone's radar in a way it had not been before. Teams that had never given much thought to what they were installing from npm suddenly started paying attention.
The worm harvested credentials and republished itself #
The payload was a bundle. js file that ran TruffleHog, a legitimate secret scanner, to sweep the host for npm tokens, GitHub credentials, and cloud keys.