Are One Identity Products impacted by the "Shai-Hulud" NPM Supply Chain Attack? (4380638)

The "Shai-Hulud" NPM Supply Chain Attack involves a self-replicating worm which targets Node Package Manager (NPM) package containers across the open-source JavaScript ecosystem with the intention of collecting sensitive authentication credentials. The impacted packages are commonly used as developer assets in the development of other software products, which can lead to vulnerabilities within those products.

To ensure customer security, One Identity followed industry best practices and tested the products listed below. Our testing did not identify any impacted packages in these products. No action is required from our customers at this time.

NOTE: We will continue to monitor this evolving situation and enhance our toolset if deemed necessary. 

• Active Roles
• Defender
• Identity Manager
• Identity Manager Data Governance Edition (DGE)
• Identity Manager On Demand Starling Edition (SE)
• One Identity Safeguard for Privileged Passwords
• One Identity Safeguard for Privileged Sessions
• OneLogin
• PAM Essentials
• Password Manager
• Privilege Manager for UNIX
• Safeguard Authentication Services
• Safeguard for Sudo
• Safeguard on Demand
• Safeguard Privilege Manager for Windows
• Starling
• Starling Connect Connectors
• Syslog-NG Open Source (OSE)
• Syslog-NG Premium Edition (PE)
• Syslog-NG Store Box (SSB)