TLDR
An npm supply chain malware called Shai Hulud infected ethereum-name-service/">ENS-linked packages and hundreds of other npm libraries, stealing developer credentials during install scripts. See the Shai Hulud report.
- Scope: over 490 npm packages and ENS-linked libraries with 132 million monthly downloads were compromised in the latest wave reported here.
- Method: code runs on install, adds Bun, uses TruffleHog to exfiltrate secrets to public GitHub repos documented here.
- Status: Ethereum Name Service updated affected packages and said ENS-operated sites appear unaffected per an update.
Deep Dive
1. What Was Hit
The campaign centered on Ethereum Name Service (ENS) scoped packages and spread across 490+ npm libraries, affecting popular developer ecosystems and crypto tooling. Coverage notes 132 million monthly downloads across the set and thousands of affected repos in aggregate as detailed here.
Packages named include multiple @ensdomains libraries and crypto utilities like create-hardhat3-app, ethereum-ens, crypto-addr-codec and even a CoinsKid-api package, indicating broad dependency reach summarized here.
Even standard scaffolding or utility installs could have pulled in the malware if versions were pinned within the window.
2. How It Worked
The Shai Hulud malware executes during package installation. It installs the Bun runtime, then invokes scanning code that uses TruffleHog to search for secrets such as API keys, GitHub or npm tokens and wallet keys if present, exfiltrating them to public GitHub repositories under rotating names explained here.
Investigators also describe environment variable exfiltration via preinstall hooks and self propagation by using any compromised credentials to push malicious updates to more packages outlined here.
Treat any machine or CI job that installed affected packages as potentially credential-compromised until secrets are rotated and access logs reviewed.
3. Impact And Mitigations
ENS said it detected the incident on 24 Nov and moved to update tags, rotate credentials and verify that ENS-operated sites remained unaffected. Developers who installed within the affected window were urged to clean caches and rotate credentials as a precaution per the update.
Security teams advise auditing dependencies, pinning versions, and disabling install scripts in CI until exposure is ruled out. Multiple researchers emphasized that this wave focused on credential harvesting rather than direct on-chain exploits, increasing lateral risk in dev and CI environments as described here.
The main risk is account and token takeover that can cascade through repos and registries. Secret rotation and dependency hygiene reduce follow-on exposure.
Conclusion
For ETH developers, this was a credential-stealing npm supply chain attack, not an Ethereum protocol issue. It leveraged preinstall hooks and dependency trust to spread widely. The practical focus now is environment hygiene, secret rotation and version pinning while teams monitor official package maintainers for remediations and advisories.
CoinsKid.Com