Threat reportThreat IntelligenceTL-2026-1867
AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scale
AWS Security Hub Extended Supply Chain Security (TL-2026-1867), also tracked as AWS Security Hub Supply Chain Security, is a medium-severity tracked intrusion set, first published 2026-08-04. It has no confirmed attribution, affects AWS Security Hub Extended — Supply Chain Security, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-1867
- Threat ID
- TL-2026-1867
- Also known as
- AWS Security Hub Supply Chain Security, Socket AWS Integration, Chainguard AWS Security Hub
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, health, government administration, defense, cryptocurrency
- Target regions
- North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in AWS Security Hub Extended Supply Chain Security
Malware and tooling: Sha1-Hulud, Shai-Hulud, TrapDoor, Nx Build System
How AWS Security Hub Extended Supply Chain Security works
On August 4, 2026, AWS announced Supply Chain Security as the 10th category in Security Hub Extended, with Socket and Chainguard as curated partners. This marks the formal recognition of supply chain security as a first-class cloud security discipline on AWS, addressing a threat landscape where open-source malware detections rose 73% year-over-year in 2025 and over 1.8 million malicious packages have been documented across npm, PyPI, Maven, NuGet, and Crates.io.
AWS Security Hub Extended has introduced Supply Chain Security as its 10th security category, onboarding Socket (socket.dev) and Chainguard as curated partner solutions. This integration brings deep behavioral analysis of open-source dependencies — including real-time malicious package detection at install time — into the AWS Security Hub console with consolidated billing and OCSF-formatted findings. Socket provides two products: Socket Firewall, which blocks malicious open-source packages at install time before they reach laptops, CI pipelines, or agent sandboxes (priced on unique artifacts checked per month), and Socket Software Composition Analysis (SCA), which provides visibility into open-source risk across shipped software (per-user pricing). Socket's detection engine uses three complementary techniques: static analysis of 70+ security red flags (install scripts, network requests, environment variable access, obfuscated code, privileged API usage), package metadata analysis (typosquatting via Levenshtein distance + download ratio comparison, HTTP dependencies, unstable ownership), and maintainer behavior analysis (out-of-order version publishing, sudden new maintainer permissions, trivial packages with suspicious refactors). The Firewall operates across npm, PyPI, Maven, Go, NuGet, and RubyGems ecosystems. Chainguard brings proactive malware prevention through hardened container images and libraries, with existing Amazon Inspector integration for CVE scanning.
The threat landscape driving this integration is severe. Sonatype's State of the Software Supply Chain 2026 reports over 1.8 million cumulatively documented malicious packages across open-source ecosystems, with 454,600+ new malicious packages discovered in 2025 alone — a 73% increase from 2024 per ReversingLabs. npm dominates as the primary attack vector, accounting for over 99% of open-source malware in 2025, with npm malware detections more than doubling from 5,290 (2024) to 10,819 (2025). The Shai-Hulud campaign (September 2025) introduced the first self-replicating npm malware, compromising approximately 1,000 packages and exposing ~25,000 GitHub repositories to malicious code injection — followed by Sha1-Hulud (November 2025). Nation-state actors have industrialized their approach: the Lazarus Group (APT38) had over 800 associated malicious packages identified in 2025, 97% on npm, evolving from simple droppers to five-stage payload chains combining credential theft and persistent remote access.
Major campaigns Socket has detected demonstrate the sophistication of modern supply chain attacks. The Mastra npm compromise (June 17, 2026) weaponized 141 @mastra/* packages — @mastra/core has 918K weekly npm downloads — via a single typosquatted transitive dependency (easy-day-js, a typosquat of dayjs). The attack deployed a two-stage implant: a self-deleting obfuscated loader (setup.cjs) that disabled TLS verification and beaconed to C2 at 23.254.164.92:8000, followed by a 41 KB cross-platform Node.js backdoor (protocal.cjs) with OS-specific persistence (Windows Run key, macOS LaunchAgent, Linux systemd user unit) and capabilities including cryptocurrency wallet inventory across 166 browser extensions, browser history theft from Chrome/Edge/Brave, and full remote tasking via a custom ICAP-style protocol. The TrapDoor campaign (May-June 2026) spanned 34+ malicious packages and 384+ versions across npm, PyPI, and Crates.io, using a shared 48 KB payload (trap-core.js) that deployed through postinstall hooks (npm), auto-execution on import (PyPI), and build.rs compilation scripts (Crates.io). It exfiltrated developer credentials, crypto wallets, SSH keys, and cloud credentials, planted persistence through .cursorrules, CLAUDE.md, git hooks, systemd, and cron, and attempted SSH-based lateral movement. The Nx build system compromise (August 2025) injected malicious versions into the Nx build tool (4.6M weekly npm downloads) via GitHub Actions workflow injection and npm token theft, weaponizing AI developer CLI tools (Claude, Gemini, Q) for filesystem reconnaissance. The TanStack compromise (2025) hit 84 npm artifacts with credential stealers targeting CI systems.
All findings from Socket and Chainguard are emitted in the Open Cybersecurity Schema Framework (OCSF) format — currently OCSF schema version 1.6 — and automatically aggregated in AWS Security Hub. This standardization enables security teams to treat supply chain findings (malicious packages, risky dependencies, compromised maintainers) consistently alongside endpoint, identity, network, and cloud security findings within a single console. The integration is available in all AWS commercial Regions where Security Hub is offered, with pay-as-you-go pricing with no long-term commitments, and existing AWS committed spend can be applied toward Socket and Chainguard usage. AWS Security Hub Extended now encompasses 23 curated partner solutions across endpoint, identity, email, network, data, browser, cloud, AI, security operations, and supply chain security categories.
MITRE ATT&CK techniques used in TL-2026-1867
Collection
T1005 Data from Local System; T1114 Email Collection; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1518 Software Discovery
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel
Initial Access
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Lateral Movement
T1563 Remote Service Session Hijacking; T1570 Lateral Tool Transfer
Exfiltration
T1567 Exfiltration Over Web Service
defense-impairment
Affected products and versions in AWS Security Hub Extended Supply Chain Security
- AWS — Security Hub Extended — Supply Chain Security
- Socket — Socket Firewall
- Socket — Socket SCA
- Chainguard — Chainguard Libraries
- Chainguard — Chainguard Containers
Remediation for AWS Security Hub Extended Supply Chain Security
Immediate actions
- Enable Supply Chain Security category in AWS Security Hub Extended to aggregate OCSF-formatted findings from Socket and Chainguard
- Deploy Socket Firewall in CI/CD pipelines and developer workstations to block malicious packages at install time
- Configure Socket GitHub App for PR-level dependency scanning before merge
- Review all @mastra/* package installations and verify no easy-day-js transitive dependency exists
Workarounds
- Enable safe-npm CLI as a drop-in replacement for npm install with AI scanning
- Configure npm config to disallow postinstall scripts where not explicitly needed: npm config set ignore-scripts true
- Implement package allowlisting/blocklisting policies via Socket org-wide firewall rules
Longer-term hardening
- Establish supply chain security policy as part of cloud security posture management via Security Hub
- Implement reachability analysis to reduce vulnerability noise by 50-80% on dependency findings
- Integrate OCSF supply chain findings into SIEM/SOAR workflows via Security Lake and Security Hub
- Adopt Chainguard Libraries for Python and Java to prevent malicious packages at the registry mirror level
- Develop automated remediation workflows for blocked malicious packages using Security Hub automation rules
Weaknesses (CWE) in AWS Security Hub Extended Supply Chain Security
Timeline of AWS Security Hub Extended Supply Chain Security
- TanStack npm package compromise: 84 npm artifacts in @tanstack namespace with credential stealers targeting CI systems. Socket detected all within 6 minutes of publication.
- Nx build system supply chain compromise: 8 malicious versions of Nx (4.6M weekly downloads) via GitHub Actions workflow injection and npm token theft. First documented supply chain attack weaponizing AI developer CLI tools (Claude, Gemini, Q).
- Shai-Hulud self-replicating npm malware discovered — first-ever self-replicating npm worm. Compromised ~1,000 packages, exposed ~25,000 GitHub repositories to malicious code injection.
- Tinycolor supply chain expansion: compromised @ctrl/tinycolor (2.2M weekly downloads) expanded to nearly 500 affected npm packages including CrowdStrike packages. Auto-trojanization via NpmModule.updatePackage.
- 60 malicious npm packages with network reconnaissance discovered: install-time scripts collecting hostnames, IPs, DNS info exfiltrated to Discord webhooks. 3,000+ combined downloads mapping developer networks for follow-on targeting.
- Sha1-Hulud self-replicating malware campaign follows Shai-Hulud, confirming industrialization of self-replicating supply chain attacks on npm.
- Beamglea phishing campaign: 175 npm packages with 26,000+ downloads targeting 135+ companies via npm + unpkg.com CDN hosting redirect scripts for credential harvesting.
- ReversingLabs reports 73% year-over-year increase in open-source malware detections. Sonatype cumulative malicious package count exceeds 1.233 million across all ecosystems.
- TrapDoor cross-ecosystem crypto-stealer campaign detected: 34+ malicious packages with 384+ versions across npm, PyPI, and Crates.io. Socket average detection time ~6 minutes, fastest 58 seconds. Used shared trap-core.js payload with SSH lateral movement and cross-platform persistence.
- Mastra npm supply chain attack: 141 @mastra/* packages compromised via typosquatted transitive dependency easy-day-js. Two-stage implant (setup.cjs loader + protocal.cjs 41KB backdoor) with 166 wallet extension targeting and OS-specific persistence.
- Lazarus Group (APT38) surpasses 800 associated malicious packages, 97% on npm, evolving to five-stage payload chains combining droppers, credential theft, and persistent remote access. Sonatype cumulative total exceeds 1.8 million malicious packages.
- AWS announces Supply Chain Security as 10th category in Security Hub Extended, onboarding Socket and Chainguard as curated partners. Findings emitted in OCSF format. Security Hub Extended now has 23 partner solutions across 10 categories.
Sources cited for AWS Security Hub Extended Supply Chain Security
- AWS Security Hub Extended Adds Supply Chain Security as Its 10th Category
- Socket + AWS Security Hub Extended Integration
- Sonatype State of the Software Supply Chain 2026
- ReversingLabs Software Supply Chain Security Report 2026
- Mastra npm Packages Compromised — Supply Chain Attack Analysis
- TrapDoor Crypto Stealer — Cross-Ecosystem Supply Chain Attack
- Nx Build System Supply Chain Compromise Analysis
- Shai-Hulud Self-Replicating npm Malware Analysis
- TanStack npm Package Compromise — CI Credential Theft
- Open Cybersecurity Schema Framework (OCSF) Documentation
- AWS Security Hub Pricing
- AWS Security Hub Extended Partners Overview
- CISA Known Exploited Vulnerabilities — Software Supply Chain
Detection coverage for TL-2026-1867
As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1867 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1867
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.