Multiple Node.js Modules compromised in self-spreading npm supply chain attack (mini-Shai-Hulud) (05/11/2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(315991);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/28");

  script_cve_id("CVE-2026-45321");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/06/10");

  script_name(english:"Multiple Node.js Modules compromised in self-spreading npm supply chain attack (mini-Shai-Hulud) (05/11/2026)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a Node.js module compromised in the mini-Shai-Hulud supply chain attack installed.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of one or more Node.js modules installed known to be compromised in the
self-spreading 'mini-Shai-Hulud' npm supply chain attack reported on 05/11/2026. This wave is tracked
separately from the original Shai-Hulud campaign because of distinct compromised maintainers (TanStack,
UiPath, DraftLab, Mistral, etc.), a different malware payload, and a different timeline.

A malicious update to these modules introduced credential harvesting that is then exfiltrated. It will then
attempt to propagate to other packages that the maintainer controls.

The list of vulnerable Node.js packages this plugin checks for is up to date as of 05/11/26. However, the impact
of this vulnerability is evolving and the list may become outdated if further vulnerable packages are discovered

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6e5a22f6");
  # https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?27b87ee3");
  # https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-hundred-npm-packages-compromised
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95063cb5");
  script_set_attribute(attribute:"solution", value:
"Update the affected node modules to a version higher than the known compromised versions.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45321");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');
include('shai_hulud.inc');

# get module names from array
var module_names = keys(mini_shai_hulud_vuln_data);

# get module installs for any of the vuln modules found on the target
var module_installs = vcf_extras::nodejs_modules::get_app_info(modules_list:module_names);

if (empty_or_null(module_installs))
  audit(AUDIT_HOST_NONE, 'mini-Shai-Hulud compromised nodejs modules installed');

vcf::check_all_backporting(app_info:module_installs);

var module_name = module_installs.app;
var fixed_display = 'Update to a newer, patched version of the module';

var vuln_versions = mini_shai_hulud_vuln_data[module_name].vuln_vers;

var constraints = [];

foreach (var vuln_vers in vuln_versions)
{
  append_element(value: {'equal': vuln_vers, 'fixed_display': fixed_display}, var:constraints);
}

vcf::check_version_and_report(app_info:module_installs, constraints:constraints, severity:SECURITY_HOLE);