Multiple Node.js Modules compromised in npm supply chain attack (Shai-Hulud 'Miasma') (06/01/2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318388);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/03");

  script_name(english:"Multiple Node.js Modules compromised in npm supply chain attack (Shai-Hulud 'Miasma') (06/01/2026)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a Node.js module compromised in the Shai-Hulud 'Miasma' supply chain attack installed.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of one or more Node.js modules installed known to be compromised in the
Shai-Hulud 'Miasma' npm supply chain attack reported on 06/01/2026. This wave compromised 32 packages
(96 versions) published under the '@redhat-cloud-services' npm scope. It is tracked separately from the
original Shai-Hulud and mini-Shai-Hulud campaigns because it is a copycat operation built on the
open-sourced mini-Shai-Hulud malware and published through a compromised CI/CD pipeline using GitHub
OIDC trusted publishing.

Each compromised package declares a 'preinstall' script that runs an obfuscated payload on every install.
The payload performs a broad credential sweep across cloud providers (AWS, GCP, Azure), CI/CD environments
(GitHub Actions tokens), and developer tooling (npm and PyPI tokens, SSH and GPG keys, .env files), which
is then exfiltrated.

The list of vulnerable Node.js packages this plugin checks for is up to date as of 06/01/26. However, the
impact of this vulnerability is evolving and the list may become outdated if further vulnerable packages
are discovered.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?73b9e974");
  # https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-hundred-npm-packages-compromised
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95063cb5");
  script_set_attribute(attribute:"solution", value:
"Update the affected node modules to a version higher than the known compromised versions.");
  script_set_attribute(attribute:"agent", value:"all");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/03");

  script_set_attribute(attribute:"risk_factor", value:"Critical");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');
include('shai_hulud.inc');

# get module names from array
var module_names = keys(miasma_shai_hulud_vuln_data);

# get module installs for any of the vuln modules found on the target
var module_installs = vcf_extras::nodejs_modules::get_app_info(modules_list:module_names);

if (empty_or_null(module_installs))
  audit(AUDIT_HOST_NONE, 'Shai-Hulud Miasma compromised nodejs modules installed');

vcf::check_all_backporting(app_info:module_installs);

var module_name = module_installs.app;
var fixed_display = 'Update to a newer, patched version of the module';

var vuln_versions = miasma_shai_hulud_vuln_data[module_name].vuln_vers;

var constraints = [];

foreach (var vuln_vers in vuln_versions)
{
  append_element(value: {'equal': vuln_vers, 'fixed_display': fixed_display}, var:constraints);
}

vcf::check_version_and_report(app_info:module_installs, constraints:constraints, severity:SECURITY_HOLE);