CTI · corroborated · 2026-09-08

npm Supply Chain Worm Returns After Four-Month Dormancy With Same Malicious Payload

Full story & timeline

MITRE ATT&CK

• T1195 Supply Chain Compromise Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1552 Unsecured Credentials Credential Access

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 sha256 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Shai-Hulud npm Worm - Preinstall Hook Credential Harvesting
id: 7c9e1f3a-5b2d-4a8c-6e0f-3d7b9a1c5e8f
status: experimental
description: Detects npm packages executing preinstall lifecycle hooks that run 'bun run index.js' or similar credential-harvesting payloads. The Shai-Hulud worm uses this mechanism to automatically execute malware when developers or CI/CD pipelines install affected dependencies.
references:
  - https://gbhackers.com/known-npm-worm-returns-after-111-days-and-security-scanning-still-let-it-through/
author: Tia N. List
date: 2026-09-08
tags:
  - attack.t1195
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_bun:
    Image|endswith: '/bun'
    CommandLine|contains: 'run'
    CommandLine|contains: 'index.js'
  selection_npm_preinstall:
    Image|endswith: '/npm'
    CommandLine|contains: 'preinstall'
    CommandLine|contains: 'bun'
  selection_credential_harvest:
    CommandLine|contains: 'npm_token'
    OR CommandLine|contains: 'github_token'
    OR CommandLine|contains: 'ssh_keyscan'
    OR CommandLine|contains: 'docker_config'
  condition: (selection_bun and selection_credential_harvest) or selection_npm_preinstall
falsepositives:
  - Legitimate bun-based development workflows running index.js (unlikely with credential keywords)
level: high

YARA-X raw

rule ShaiHulud_NPM_Worm_Payload {
  meta:
    author = "Tia N. List"
    date = "2026-09-08"
    status = "experimental"
    description = "Detects the Shai-Hulud npm supply-chain worm payload. The malware harvests npm tokens, GitHub tokens, cloud credentials, SSH keys, and CI/CD secrets from compromised development environments."
    reference = "https://gbhackers.com/known-npm-worm-returns-after-111-days-and-security-scanning-still-let-it-through/"
    falsepositives = "None expected; payload hash e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 is known malicious"
  strings:
    $s1 = "npm_token" ascii
    $s2 = "github_token" ascii
    $s3 = "ssh_keyscan" ascii
    $s4 = "docker_config" ascii
    $s5 = "ci_cd" ascii nocase
    $hook = "preinstall" ascii
    $bun = "bun run index.js" ascii
  condition:
    $hook and $bun and 3 of ($s*)
}

References

• https://gbhackers.com/known-npm-worm-returns-after-111-days-and-security-scanning-still-let-it-through/