Multiple Node.js Modules compromised in supply chain attack to harvest credentials (Shai-Hulud) (11/25/2025)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265897);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/21");

  script_name(english:"Multiple Node.js Modules compromised in supply chain attack to harvest credentials (Shai-Hulud) (11/25/2025)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a compromised Node.js module installed.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of one or more Node.js modules installed known to be compromised in a supply
chain attack (Shai-Hulud). The modules that are vulnerable are referenced here:

  - https://github.com/tenable/shai-hulud-second-coming-affected-packages/blob/main/list.md.

A malicious update to these modules introduced credential harvesting that is then exfiltrated. It will then
attempt to propagate to other packages that the maintainer controls.

The list of vulnerable Node.js packages this plugin checks for is up to date as of 11/25/25. However, the impact
of this vulnerability is evolving and the list may become outdated if further vulnerable packages are discovered

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?27b87ee3");
  # https://github.com/tenable/shai-hulud-second-coming-affected-packages/blob/main/list.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6e28aba6");
  # https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-hundred-npm-packages-compromised
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95063cb5");
  script_set_attribute(attribute:"solution", value:
"Update the affected node modules to a version higher than the known compromised versions.");
  script_set_attribute(attribute:"agent", value:"all");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/25");
  
  script_set_attribute(attribute:"risk_factor", value:"Critical");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');
include('shai_hulud.inc');

# Note: at the time of writing, we have advisories and fixed versions only for a subset of the vuln modules
# get module names from array, serialize into string and swap [] (NASL list) with () (SQL list)
var module_names = keys(shai_hulud_vuln_data);

# get module installs for any of the vuln modules found on the target
var module_installs = vcf_extras::nodejs_modules::get_app_info(modules_list:module_names);

if (empty_or_null(module_installs))
  audit(AUDIT_HOST_NONE, 'vulnerable nodejs modules installed');

vcf::check_all_backporting(app_info:module_installs);

var module_name = module_installs.app;
var fixed_display = 'Update to a newer, patched version of the module';

var vuln_verisons = shai_hulud_vuln_data[module_name].vuln_vers;

var constraints = [];

foreach (var vuln_vers in vuln_verisons)
{
  append_element(value: {'equal': vuln_vers, 'fixed_display': fixed_display}, var:constraints);
};

vcf::check_version_and_report(app_info:module_installs, constraints:constraints, severity:SECURITY_HOLE);