Shai-Hulud npm worm resurfaces, bypassing security scans

As outlined in IT Pro, the Shai-Hulud npm worm, previously thought to be neutralized, has reappeared in a new campaign that successfully bypassed npm's recently implemented security measures.

Researchers at Aikido Security discovered four packages containing the Shai-Hulud worm, which had the same malicious payload hash as the original attack from May. This resurgence is particularly concerning because the worm managed to slip through npm's publish-time malware scanning, a system designed to hold packages for several minutes to detect threats. The fact that a hash-identical payload, widely documented and previously detected, could bypass this automated check raises significant questions about the effectiveness of current security protocols, researchers said.

The targeted entities are developers and organizations relying on the npm registry for software packages. This incident highlights a weakness in supply chain security, suggesting that even enhanced scanning mechanisms may not be sufficient to prevent known threats from re-emerging.

Source: IT Pro