Open Source ·
@ctrl/tinycolor hit by Shai-Hulud
An attacker targeted a shared repository (angulartics2) where the maintainer had admin rights. They pushed a malicious branch (Shai-Hulud) containing a GitHub Actions workflow that immediately ran, exfiltrating a static npm token with broad publish rights.
Part of Shai-Hulud npm worm stole developer secrets campaign
@ctrl/tinycolor was not compromised through its own repository. The maintainer still had admin rights on a shared repository, angulartics2, which held an npm token with broad publish authority.
An attacker force-pushed a Shai-Hulud branch to that shared repository. Because the actor had admin-level access, the malicious GitHub Actions workflow ran without pull request review and exfiltrated the npm token.
The stolen token was enough. The attacker published malicious versions of @ctrl/tinycolor and other packages, and the bad releases carried the Shai-Hulud postinstall payload. @ctrl/tinycolor mattered most because it had roughly two million weekly downloads.
npm and GitHub removed the malicious versions quickly. The maintainer revoked tokens, republished clean packages to flush caches, and moved toward tighter publishing controls with package-scoped tokens and Trusted Publishing.
Appendix · Affected releases
- The reported SHA-256 identifies the shared malicious bundle.js payload, not either complete npm tarball.
Indicators
- file_sha256bundle.js 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09
References
- "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack - Unit 42unit42.paloaltonetworks.com
- @ctrl/tinycolor supply chain attack post-mortemsigh.dev
- Shai-Hulud npm supply chain attackwiz.io
- @ctrl/tinycolor supply chain attack affects 40 packagessocket.dev
- @ctrl/tinycolor and 40 NPM packages compromisedstepsecurity.io
- Hacker News: @ctrl/tinycolor and 40 NPM packages compromisednews.ycombinator.com
Source record: oss/attacks/ctrl-tinycolor/meta.yaml