Compromised GitHub Automation Injects Backdoor into Ethereum npm Package
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors compromised Ethersphere's GitHub automation pipeline to publish malicious versions of a trusted npm package and desktop application, embedding a loader that fetched and executed arbitrary JavaScript with full Node.js privileges. This is a classic software supply chain attack: by hijacking the build and release infrastructure rather than the source code directly, the attacker bypassed typical code review processes and inherited the trust users placed in the legitimate publisher. The reuse of infrastructure from a prior campaign (SleepyDuck/EtherDuck) suggests a persistent, targeted threat actor operating against the Ethereum ecosystem. This matters because downstream developers and end users who automatically consume package updates are silently compromised with no visible warning. Trust in open-source ecosystems depends on the integrity of CI/CD pipelines and package signing, both of which failed here.
Tactical Insight
Immediate actions
- Audit and rotate all GitHub automation credentials, secrets, and tokens associated with the compromised repositories immediately.
- Yank or deprecate the malicious npm package versions and issue a public advisory to downstream consumers specifying safe version ranges.
- Scan all systems that consumed the malicious package versions for indicators of compromise tied to SleepyDuck/EtherDuck infrastructure.
Long-term improvements
- Enforce multi-party approval (e.g., required reviewers + protected branch rules) for any automated workflow that publishes packages to npm or GitHub Releases.
- Implement npm package provenance and code signing (e.g., Sigstore/npm provenance attestations) so consumers can cryptographically verify that published artifacts originate from the expected CI pipeline.
- Apply the principle of least privilege to all CI/CD service accounts, ensuring automation tokens cannot publish releases without a secondary human or policy gate.
Detection measures
- Monitor npm publish events and GitHub Release creation via audit logs and alert on any release triggered outside of normal business hours or from unexpected runner environments.
- Integrate software composition analysis (SCA) tools into consumer pipelines to flag newly introduced remote code fetching behavior or unexpected network calls in updated dependencies.