Analytics Story: NPM Supply Chain Compromise

Updated Date: 2026-05-13 ID: 104cc589-d3a9-493a-8755-4376f706a00c Author: Michael Haag, Splunk Product: Splunk Enterprise Security

Description

Behavioral detections and hunting content for detecting npm supply chain compromises, including the Shai-Hulud worm and its 2.0 variant. Focuses on preinstall/postinstall script abuse, credential exfiltration via curl/wget, malicious GitHub Actions workflow injection (shai-hulud-workflow.yml, discussion.yaml), package file patching, cloud credential harvesting, self-hosted runner backdoors, and rapid npm publishing activity.

Why it matters

Recent incidents highlight self-replicating worms ("Shai-Hulud" and "Shai-Hulud 2.0") abusing the npm ecosystem.

After compromising developer credentials, malicious packages execute during preinstall/postinstall phases to exfiltrate secrets, plant malicious GitHub Actions workflows, register self-hosted runner backdoors, and republish tampered packages to spread across the ecosystem.

Shai-Hulud 2.0 (November 2025) introduced new payload files (setup_bun.js, bun_environment.js), exfiltration artifacts (cloud.json, contents.json, environment.json, truffleSecrets.json), and a backdoor workflow (discussion.yaml) that enables remote command execution via GitHub Discussions on compromised self-hosted runners named "SHA1HULUD".

The campaign has affected 25,000+ repositories across ~500 GitHub users, with propagation rates of ~1,000 new repos every 30 minutes.

This story provides Linux and Windows analytics using Sysmon, auditd, and GitHub audit logs. Prioritize monitoring npm installs, curl/wget posts, node_modules file patching, workflow YAML writes under .github/workflows, self-hosted runner registrations, and cloud credential file access.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
GitHub Organizations Delete Branch Ruleset	Supply Chain Compromise, Disable or Modify Tools	Anomaly
File Download or Read to Pipe Execution	Ingress Tool Transfer	TTP
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Shai-Hulud 2 Exfiltration Artifact Files	Local Data Staging, Compromise Software Supply Chain, Credentials In Files	TTP
Windows Curl Download to Suspicious Path	Ingress Tool Transfer	TTP
GitHub Enterprise Disable Audit Log Event Stream	Supply Chain Compromise, Disable or Modify Cloud Log	Anomaly
Windows Curl Upload to Remote Destination	Ingress Tool Transfer	TTP
GitHub Organizations Repository Deleted	Supply Chain Compromise, Data Destruction	Anomaly
GitHub Enterprise Delete Branch Ruleset	Supply Chain Compromise, Disable or Modify Tools	Anomaly
GitHub Enterprise Repository Archived	Supply Chain Compromise, Data Destruction	Anomaly
GitHub Workflow File Creation or Modification	Supply Chain Compromise, Compromise Host Software Binary, Dynamic Linker Hijacking	Hunting
Linux Ingress Tool Transfer with Curl	Ingress Tool Transfer	Anomaly
GitHub Enterprise Modify Audit Log Event Stream	Supply Chain Compromise, Disable or Modify Cloud Log	Anomaly
GitHub Enterprise Repository Deleted	Supply Chain Compromise, Data Destruction	Anomaly
GitHub Enterprise Pause Audit Log Event Stream	Supply Chain Compromise, Disable or Modify Cloud Log	Anomaly
GitHub Organizations Repository Archived	Supply Chain Compromise, Data Destruction	Anomaly
Shai-Hulud Workflow File Creation or Modification	Supply Chain Compromise, Compromise Host Software Binary, Dynamic Linker Hijacking	TTP
GitHub Enterprise Register Self Hosted Runner	Supply Chain Compromise, Disable or Modify Tools	Anomaly
Linux Ingress Tool Transfer Hunting	Ingress Tool Transfer	Hunting
Linux Curl Upload File	Ingress Tool Transfer	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
GitHub Organizations Audit Logs	Other	`github:cloud:audit`	`github`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Sysmon for Linux EventID 11	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
GitHub Enterprise Audit Logs	Other	`httpevent`	`http:github`
Cisco Isovalent Process Exec	Other	`cisco:isovalent:processExec`	`not_applicable`

References

Source: GitHub | Version: 3