Recent High-profile supply‐chain attacks have exposed critical weaknesses in package registry security, prompting GitHub to roll out a suite of defenses designed to harden the npm ecosystem. 

“GitHub Enhances npm’s security with strict authentication, granular tokens, and trusted publishing” marks the latest milestone in defending open source against account takeovers and malicious post-install payloads.

Account Takeovers and Post-Install Malware

In mid-September 2025, the npm registry was rocked by the Shai-Hulud attack, a self-replicating worm that leveraged compromised maintainer credentials to inject malicious JavaScript into widely used packages. 

By embedding post-install scripts that exfiltrated environment variables and API secrets, the worm threatened to create a persistent backdoor across thousands of developer machines. 

Attackers deployed Indicators of Compromise (IoCs) that included obfuscated PowerShell one-liners and rogue script tags to harvest tokens and credentials. 

Over 500 infected modules were unpublished within 24 hours, and npm blocked uploads containing the worm’s IoCs.

This breach underscores how malicious actors exploit weak authentication and overly permissive tokens. Without multi-factor enforcement or scoped tokens, a single stolen classic token can become a foothold for escalating privileges, distributing malware, or pivoting deeper into critical projects.

Security Measures to Prevent Compromise

To counter token abuse and prevent future supply-chain compromise, GitHub is introducing three core measures:

Strict authentication

All npm publish operations will require enforced two-factor authentication (2FA) using FIDO2/WebAuthn. The legacy Time-based One-Time Password (TOTP) method will be deprecated, eliminating vulnerabilities associated with shared seed values or SMS fallback.

Granular tokens

Developers will generate short-lived granular access tokens with scoped permissions for example, read:packages or publish:package-name—and a maximum lifetime of seven days. 

Classic tokens will be deprecated entirely, removing the risk of unlimited-scope credentials persisting indefinitely.

Trusted publishing

Leveraging OpenSSF’s Trusted Publishers specification, maintainers can bind package publication to established identity providers via OIDC. 

This eliminates the need to embed API tokens in CI/CD pipelines, reducing exposure during build processes.

Additional measures include disabling token bypass for local publishing, expanding the roster of supported identity providers, and publishing migration guides to integrate these changes seamlessly. 

GitHub plans a phased rollout with configurable enforcement windows, allowing organizations to adapt CI workflows and update automation scripts without disruption.

As the open source ecosystem scales, security remains a collective responsibility. By adopting FIDO2-based 2FA, migrating to granular tokens, and embracing trusted publishing, npm maintainers can greatly reduce the attack surface for supply-chain threats. 

These enhancements not only protect individual projects but also reinforce the integrity of the software industry’s foundational infrastructure.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post GitHub Enhances NPM’s Security with Strict Authentication, Granular Tokens, and  Trusted Publishing appeared first on Cyber Security News.

A sophisticated cyber campaign, dubbed “Operation Rewrite,” is actively hijacking Microsoft Internet Information Services (IIS) web servers to serve malicious content through a technique known as search engine optimization (SEO) poisoning.

Palo Alto Networks uncovered the operation in March 2025, attributing it with high confidence to a Chinese-speaking threat actor who uses a malicious IIS module known as BadIIS.

The campaign’s primary goal is financial gain by manipulating search engine results to redirect unsuspecting users to unwanted websites, such as gambling and pornography platforms.

The attackers compromise legitimate, high-reputation websites, turning them into unwitting conduits for their malicious activities.

BadIIS Malware and SEO Poisoning

At the heart of this operation is BadIIS, a malicious native module for Microsoft’s IIS web server software. First identified in 2021, these modules integrate directly into the web server’s core processes, granting them high-level privileges.

This deep integration allows the malware to intercept, inspect, and modify all incoming and outgoing web traffic. Attackers leverage this control to inject malicious code, redirect users, and steal sensitive information without being easily detected.

The attackers use BadIIS to conduct SEO poisoning. Instead of building new malicious websites, which are difficult to rank in search engines, they compromise established sites that already have a good reputation.

By injecting popular search keywords into the compromised site’s content, they trick search engines like Google and Bing into ranking the site for a wide range of unrelated queries.

The “Operation Rewrite” campaign unfolds in two distinct phases designed to first deceive search engines and then ensnare human victims.

• The Lure Phase: The attack begins when a search engine crawler (like Googlebot) visits a compromised server. The BadIIS module detects the crawler by inspecting its User-Agent header. It then communicates with a command-and-control (C2) server to fetch keyword-rich, poisoned content. This content is served only to the crawler, causing the search engine to index the legitimate website for popular but irrelevant terms. Analysis shows a specific focus on East and Southeast Asia, with keywords for Vietnamese search engines and terms related to illegal soccer streaming services.

• The Trap Phase: Once the search results are poisoned, the trap is set. When a user clicks on the malicious search result, the BadIIS module identifies them as a human victim by checking the Referer header. Instead of showing the expected webpage, the module contacts the C2 server again to fetch a redirect link to a scam website. The compromised server acts as a reverse proxy, seamlessly sending the victim to the attacker-controlled destination.

Palo Alto Networks has linked this activity cluster, tracked as CL-UNK-1037, to a Chinese-speaking threat group. The name “Operation Rewrite” stems from the Pinyin transliteration “chongxiede” (重写), meaning “rewrite,” which was found as an object name in the malware’s code.

Further investigation revealed additional linguistic evidence, including code comments written in simplified Chinese characters.

The group’s toolkit is not limited to the native BadIIS module. The investigation uncovered several variants, demonstrating the actor’s adaptability.

These include lightweight ASP.NET page handlers, managed .NET IIS modules, and an all-in-one PHP script, all designed to achieve the same SEO poisoning goals through different technical means.

Researchers noted significant overlaps in infrastructure and code design with a publicly tracked threat cluster known as “Group 9” and tactical similarities to the “DragonRank” campaign, suggesting a connection within a broader ecosystem of threat actors.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and set CSN as a Preferred Source in Google.

The post Hackers Hijacking IIS Servers Using Malicious BadIIS Module to Serve Malicious Content appeared first on Cyber Security News.