Over 400 npm Packages Infected by Credential-Stealing Worm

A self-replicating worm, identified as a variant of Mini Shai-Hulud, has compromised over 400 npm packages from various unrelated publishers. The malware is designed to steal developer credentials and propagate itself by publishing malicious versions of the affected libraries. Notable packages impacted include keyv, flat-cache, and cache-manager. The worm exploits vulnerabilities in the npm ecosystem to facilitate its spread. Developers are urged to review their dependencies and take necessary precautions. The attack highlights significant risks within the software supply chain. No specific CVEs have been reported yet, but the scale of the infection raises alarms.

Key Points: • Over 400 npm packages have been compromised by a self-replicating worm. • The malware steals developer credentials and propagates through malicious package updates. • Key affected packages include keyv, flat-cache, and cache-manager.