Shai-Hulud Strikes Again

Cyber News
,
1

This time around, there are some significant differences in the attack:

  • It install bun with the file setup_bun.js and then uses that to execute bun_environment.js which is the actual malicious code.
  • It creates a randomly named repository with stolen data, rather than a hardcoded name.
  • It will infect up to 100 npm packages, compared to 20 last time.
  • If it can’t authenticate with GitHub or NPM, it will wipe all files in the users Home directory.