Analysis of npm/PyPI Supply Chain Attacks Stealing CI Tokens and Secrets

Vulnerability Overview This webpage describes four supply chain attack incidents targeting npm and PyPI. These attacks exploit trust relationships within the developer community, using malicious packages or updates to steal sensitive information. Scope of Impact 1. Attack 1: Radon Brings the Shal-Nulad Wares to PyPI - Scope of Impact: Multiple packages on the PyPI platform. - Attack Method: Stealing users' GitHub tokens via malicious packages. 2. Attack 2: Fake Payment SDKs Harvest CI Secrets on npm and PyPI - Scope of Impact: Multiple packages on both the npm and PyPI platforms. - Attack Method: Stealing sensitive information from CI/CD environments using fake payment SDKs. 3. Attack 3: 3 Stolen npm Token Poisons Jiracloud - Scope of Impact: Multiple packages on the npm platform. - Attack Method: Stealing npm tokens to further attack the Jiracloud service. 4. Attack 4: AsyncAPI’s Own CI Pipeline Turned Against It - Scope of Impact: The CI/CD pipeline of the AsyncAPI project. - Attack Method: Stealing sensitive information from the project by compromising the CI/CD pipeline. Remediation Measures 1. Strengthen Package Review Mechanisms - Implement stricter reviews for packages uploaded to npm and PyPI to ensure their origins are reliable. 2. Enhance Developer Security Awareness - Educate developers on identifying and preventing malicious packages, and avoid installing packages from untrusted sources. 3. Use Multi-Factor Authentication - Enable multi-factor authentication when accessing sensitive resources to increase the difficulty of attacks. 4. Regular Updates and Monitoring - Regularly update packages and dependencies, monitor for anomalous activities, and promptly detect and respond to potential threats. POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Summary These four supply chain attack incidents demonstrate how attackers exploit trust relationships within the developer community to steal sensitive information through malicious packages or updates. To prevent such attacks, it is necessary to strengthen package review mechanisms, enhance developer security awareness, use multi-factor authentication, and perform regular updates and monitoring.

Goal Reached Thanks to every supporter — we hit 100%!

Analysis of npm/PyPI Supply Chain Attacks Stealing CI Tokens and Secrets