What Happened: Key Details of the Incident

• The compromise originated from the npm account crowdstrike-publisher, which has been used to publish several officially branded CrowdStrike packages.
• Attackers embedded a malicious bundle.js script in those packages. Once executed, the script triggers a multi-stage process: first scanning for secrets using TruffleHog (an open-source tool commonly used for detecting credentials), validating found secrets, then installing unauthorized GitHub Actions workflows to maintain persistence. All stolen data are exfiltrated to a hardcoded webhook controlled by the threat actors.
• Affected packages include various versions of @crowdstrike/commitlint, @crowdstrike/glide-core, @crowdstrike/logscale-dashboard, eslint-config-crowdstrike and others. Specific versions have been identified.
• The SHA-256 hash of the malicious bundle.js has been disclosed as 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09.

CrowdStrike has confirmed that these packages are not used in its Falcon sensor, and that the core platform is not affected. To mitigate the risk, the compromised npm packages have been removed, and CrowdStrike has rotated its public registry keys.

Background: The “Shai-Halud” Campaign & Supply Chain Risks

This incident builds on an earlier compromise involving the tinycolor npm package. The same malware and tactics were used in that previous breach, establishing a modus operandi for the Shai-Halud campaign.

Supply chain vulnerabilities in open source software have been an escalating concern. Attackers often exploit trust in widely used packages to distribute malicious code broadly—especially via dependencies that may be lightly audited. Once attackers gain access, they can compromise developer or production environments, often via CI/CD pipelines or automated workflows (like GitHub Actions).

In this case, embedding malicious code into commonly used or implicitly trusted development-tooling packages increases the potential reach of such attacks.

Expert Insight & Implications

While no independent third-party names speak in the original report, several lessons emerge:

• Credential Hygiene & Rotation: Any npm tokens or other secrets that might have been exposed should be rotated immediately. Even credentials that seem innocuous might give attackers pivot points.
• CI/CD Security: Since attackers are pushing unauthorized GitHub Actions workflows, reviewing existing workflows for unusual or unexpected changes is critical. All pipelines should be audited.
• Monitoring & Logging: Keeping an eye on logs for unusual npm publish events, package modifications, or new dependencies being pulled in can help detect malicious activity early.

These steps are especially important in enterprise settings where many developers, automated systems, and older dependencies may be in use—and where the cost of exposure is high.

Conclusion

The CrowdStrike npm package compromise via the Shai-Halud supply chain attack is another stark reminder of the fragility of trust in open source ecosystems. Though the immediate risk to the Falcon platform appears minimal, the potential for credential theft, persistent access, and wider spread damage remains serious. Developers and organizations using affected packages must act now: remove compromised packages, rotate exposed credentials, examine CI/CD workflows, and continuously monitor for suspicious changes. The threat ecosystem may evolve, but strong operational hygiene and prompt response can help reduce harm.

The post CrowdStrike’s npm Packages Hit by “Shai-Halud” Supply Chain Attack appeared first on CyberHood Sentinel.

How Silk Typhoon Attacks IT Supply Chains

Silk Typhoon now focuses on compromising IT service providers, allowing them to pivot into their customers’ networks. Their tactics include:

Exploiting stolen API keys and credentials to gain unauthorized access.
Targeting managed service providers (MSPs) and cloud infrastructure for broader reach.
Abusing Microsoft and third-party cloud services to evade detection.
Leveraging web shells and stolen credentials for persistence and lateral movement.

Industries and Organizations Affected

According to Microsoft, Silk Typhoon is actively attacking organizations in multiple sectors, including:

IT & Cloud Service Providers
Healthcare & Pharmaceuticals
Government Agencies & Defense
Higher Education & Research
Energy & Critical Infrastructure

Recent Exploits and Vulnerabilities Used

Security researchers have observed Silk Typhoon exploiting zero-day vulnerabilities such as:

CVE-2025-0282 – A critical flaw in Ivanti Pulse Connect VPN, actively used for remote access.
Password Spraying Attacks – Using leaked enterprise credentials from public sources like GitHub.
Cloud Credential Theft – Targeting privileged access management (PAM) and cloud apps.

How to Protect Your Organization

Given the growing sophistication of Silk Typhoon’s supply chain attacks, organizations must adopt proactive cybersecurity measures:

Implement Multi-Factor Authentication (MFA) to prevent credential-based attacks.
Regularly Audit API Keys and Credentials to detect unauthorized use.
Update Security Patches Immediately to mitigate zero-day exploits.
Monitor for Suspicious Activity in Cloud Services and endpoint devices.

Final Thoughts

The expansion of Silk Typhoon’s cyber-attacks into IT supply chains highlights the urgent need for enhanced security in enterprise networks. Organizations should stay vigilant, adopt a zero-trust approach, and regularly review security practices to mitigate risks.

For more updates on cybersecurity threats and solutions, subscribe to our newsletter .

The post China-Linked Silk Typhoon Expands Cyber Attacks: IT Supply Chains at Risk appeared first on CyberHood Sentinel.

The threat actor TA569 is behind these attack which inject malicious codes in Java Script files of various media outlet websites. The users who will be visiting these malicious websites will also likely to get infected by the SocGholish. The malware will push fake browser updated to the website visitors (e.g. Oper.Updte.zip ,Operа.Updаte.zip,Chromе.Uрdatе.zip, Chrome.Updater.zip, Firefoх.Uрdatе.zip ).

Proof point threat intel team revealed today that “Proofpoint Threat Research has observed intermittent injections on a media company that serves many major news outlets. This media company serves content via Javascript to its partners,”

“By modifying the codebase of this otherwise benign JS, it is now used to deploy SocGholish.”

In total, the malware has been installed on sites belonging to more than 250 U.S. news outlets, some of them being major news organizations, according to security researchers at enterprise security firm Proofpoint.

Proofpoint has previously observed SocGholish campaigns using fake updates and website redirects to infect users, including, in some cases, ransomware payloads.

The Evil Corp cybercrime gang also used SocGholish in a very similar campaign to infect the employees of more than 30 major U.S. private firms via fake software update alerts delivered via dozens of compromised U.S. newspaper websites.

The infected computers were later used as a stepping point into the employers’ enterprise networks in attacks attempting to deploy the gang’s WastedLocker ransomware.

Luckily, Symantec revealed in a report that it blocked Evil Corp’s attempts to encrypt the breached networks in attacks targeting multiple private companies, including 30 U.S. corporations, eight of them Fortune 500 companies.

The post SocGholish supply-chain attack targets US sites appeared first on CyberHood Sentinel.

The units that are targeted by the attackers are as follows the Energy Ministry, the Federal State Statistics Service, the Federal Penitentiary Service, the Federal Bailiff Service, the Federal Antimonopoly Service, the Culture Ministry, and other Russian state agencies.

The incident was discovered on the 8th of March after attackers blocked access to the site and published their own banners.

“It is difficult to compromise these websites directly, so hackers attack resources through external services and thus gain access to demonstrate incorrect content,” the press service of the Russian Ministry of Economic Development told Interfax.

“After hacking the widget, hackers were able to publish incorrect content on the pages of the websites. The incident was promptly localized.”

The Russian digital development ministry maintains that the websites are brought back within after an hours after the breach.

The origin of attack is still unknown. It is also mentioned by the Russian ministry that they have launched a Forensic investigation of the attack.

The post Supply Chain attack targeted Russian government Sites appeared first on CyberHood Sentinel.