The malware has reached packages with a combined 2 billion monthly downloads, affecting major organizations including Deliveroo, Picsart, and ServiceTitan.
The breach is significant because it uses a "supply-chain attack," where malicious code is inserted into trusted software building blocks to infect any system that downloads them.
By pushing files directly to project branches and using legitimate GitHub Actions—automated workflows for building software—the attacker generated releases that appeared authentic to security filters.
Once a user runs a standard installation command, a hidden script automatically executes to steal sensitive data, such as cloud credentials and private access tokens, from developer workstations and automated coding environments.
To facilitate the theft, the malware downloads a legitimate tool called the Bun runtime to run heavily hidden scripts that search for AWS, GitHub, and Kubernetes secrets.
Security researchers warn that because the worm is designed to spread by using stolen credentials to infect more repositories, the number of affected packages is expected to grow.
Administrators are advised to treat any system that installed a compromised version as fully breached, requiring them to rotate all accessible security keys and rebuild systems from scratch to ensure the malicious code is completely removed.