ShaiWorm: Multi-Stage Credential-Harvesting Worm Analysis

This technical report details the ShaiWorm malware, a multi-stage credential-harvesting worm that exploits compromised versions 2.6.2 and 2.6.3 of the PyTorch Lightning package. The report outlines the infection mechanism, which activates upon importing the package rather than during installation, allowing the malware to evade detection. It describes how the worm targets various credentials, including cloud service tokens and GitHub credentials, and how it propagates through the npm ecosystem by injecting malicious hooks into local packages. The report also discusses the implications of the attack on the machine learning community, emphasizing the need for immediate remediation steps, including credential rotation for affected environments. Additionally, it highlights the challenges in detecting the malware due to its sophisticated obfuscation techniques and the timing of its activation. The report concludes with a call for vigilance in monitoring both Python and JavaScript ecosystems to prevent further propagation of the worm.