GitLab discovers widespread npm supply chain attack

This post details the discovery and technical analysis of a widespread npm supply chain attack. It describes the malware's multi-stage loading process via `setup_bun.js`, credential harvesting techniques (GitHub, npm, AWS, GCP, Azure), data exfiltration network using attacker-controlled GitHub repositories, and supply chain propagation by injecting malicious code into other packages. Crucially, it details the 'dead man's switch' mechanism that triggers data destruction if access to exfiltration and propagation channels is lost. Indicators of compromise and how GitLab's Dependency Scanning can help detect this campaign are also provided.