A Self-Spreading Worm Got Into the Code Behind Billions of Installs
Almost every app is built from thousands of small pieces of free, shared code. Your computer downloads and runs them automatically. This week, someone booby-trapped one of those pieces.
More than 400 packages. Over 2 billion installs a month.
The trap is a worm: code that copies itself from victim to victim on its own. Within hours, it reached more than four hundred code packages, installed over two billion times a month.
One hijacked account poisoned eight packages at once.
The attackers took over one programmer’s account. That person maintained a family of small packages, so one break-in poisoned eight at once. Because the poisoned versions came from the real owner’s account, they looked completely legitimate.
One hidden line, then it hunts for your keys.
Each poisoned package hides one extra line. It tells your computer to run the package’s own code automatically, the moment you download it, before you use anything. That code searches two hundred places developers hide their keys. Those keys unlock a company’s cloud, its payments, its chat. The code steals them.
It steals your keys, then uses them to spread.
Among the keys the worm steals are the ones that let the victim publish code. It uses those to poison more packages: it lists every package that key can publish, slips in the same trap, bumps the version, and republishes. Everyone who installs those becomes the next carrier. With another key, the worm plants a copy of itself in your project’s settings, so it runs again the moment you open that project in your editor. Each victim’s keys fuel the next round.
It signs its own loot: “Here We Go Again.”
The worm posts the stolen keys to public pages anyone can read, each stamped “Shai-Hulud: Here We Go Again.” That tag is how it was found, and named.
One hijacked account. A worm that spreads on your own keys.
So the everyday act of adding a piece of code became a machine that steals your keys and spreads itself. The cleanup is still under way.
