Full Report
Detect and mitigate malicious npm packages linked to the recent Shai-Hulud-style campaign - Mini Shai Hulud.
Analysis Summary
# Tool/Technique: Mini Shai Hulud
## Overview
Mini Shai Hulud is a sophisticated supply chain attack campaign targeting the SAP ecosystem via malicious npm packages. The attack uses modified versions of legitimate packages to inject a multi-stage credential stealer and propagation framework. Its primary purpose is to harvest developer secrets and CI/CD credentials to facilitate further lateral movement and supply chain compromise.
## Technical Details
- **Type:** Malware (Credential Stealer / Worm)
- **Platform:** Windows, Linux, macOS (Cross-platform via Node.js and Bun runtime)
- **Capabilities:** Credential harvesting (Cloud, Git, Kubernetes), CI/CD secret extraction, automated propagation, and geofencing.
- **First Seen:** Reported April 29, 2026.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.001 - Supply Chain Compromise: Compromise Software Dependencies
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1204.002 - User Execution: Malicious File
- **TA0006 - Credential Access**
- T1552 - Unsecured Credentials
- T1555 - Credentials from Web Browsers
- **TA0007 - Discovery**
- T1613 - Container and Resource Discovery
- T1135 - Network Share Discovery
- **TA0010 - Exfiltration**
- T1567.001 - Exfiltration Over Web Service: Exfiltration to Code Repository
## Functionality
### Core Capabilities
- **Malicious Preinstall Scripts:** Leverages `npm` preinstall hooks in `package.json` to execute `setup.mjs` immediately upon package installation.
- **Runtime Sourcing:** Downloads the **Bun** runtime to execute its secondary obfuscated payload (`execution.js`), likely to bypass security tools monitoring standard Node.js behavior.
- **Broad Credential Theft:** Specifically targets:
- **Cloud Providers:** AWS, Azure, and GCP credentials/tokens.
- **CI/CD:** GitHub Actions secrets and tokens.
- **Developer Tools:** `.npmrc` files, `.gitconfig`, and Kubernetes (`kubeconfig`) tokens.
- **Memory Scraping:** Extracted secrets from the memory of active CI/CD runners.
### Advanced Features
- **Anti-Analysis/Geofencing:** Checks the system language; if set to Russian ("ru"), the malware terminates execution without exfiltrating data.
- **Propagation Logic:** Contains code to use stolen GitHub/npm tokens to infect other repositories and packages, acting as a software worm.
- **Obfuscated Data Exfiltration:** Uses a custom cipher (`__decodeScrambled`) to encrypt stolen data before posting it to attacker-controlled public GitHub repositories.
## Indicators of Compromise
### File Hashes (SHA256)
- **setup.mjs (Shared Dropper):** `4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34`
- **execution.js (@cap-js/postgres):** `eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb`
- **execution.js (@cap-js/sqlite):** `6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95`
- **execution.js (mbt):** `80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac`
### File Names
- `setup.mjs`
- `execution.js`
### Network Indicators
- Attacker-controlled repositories on `github[.]com` (used for data exfiltration).
- Downloads of the Bun runtime from official or mirrored sources during the "preinstall" phase.
### Behavioral Indicators
- Unexplained `npm` or `node` processes spawning a `bun` executable.
- Outbound HTTPS traffic to GitHub repositories from CI/CD runners that do not typically commit code.
- File read access to sensitive directories like `~/.aws/`, `~/.ssh/`, or `~/.kube/` during an `npm install` command.
## Associated Threat Actors
- **TeamPCP:** Attributed based on overlaps in code obfuscation techniques, the use of the `__decodeScrambled` cipher, and the specific Russian-language geofencing guardrails.
## Detection Methods
- **Signature-based:** Scan artifact stores and `node_modules` for the SHA256 hashes listed above.
- **Behavioral:** Monitor for `preinstall` scripts in `package.json` that fetch external binaries or access sensitive local hidden directories (`.aws`, `.ssh`).
- **Audit:** Inspect CI/CD logs for unexpected scripts running during the dependency installation phase of a build.
## Mitigation Strategies
- **Pin Dependencies:** Use lockfiles (`package-lock.json`) and avoid using "latest" tags or loose versioning for sensitive packages.
- **Namespace Verification:** Only use verified scoped packages (e.g., ensure `@cap-js` packages are coming from the legitimate SAP registry).
- **Network Segmentation:** Restrict CI/CD runners' egress traffic to prevent exfiltration to unauthorized domains.
- **Credential Rotation:** Immediately rotate any GitHub, npm, or Cloud keys that may have been present on systems where the malicious packages were installed.
## Related Tools/Techniques
- **Shai-Hulud:** The predecessor campaign from which this "Mini" variant derives its name and logic.
- **Typosquatting/Dependency Confusion:** General techniques often used alongside this delivery method.