Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception

Open-Source Supply Chain Poisoning Campaigns Drive (TL-2026-2294), also tracked as Mini Shai-Hulud, is a high-severity supply-chain compromise, first published 2026-09-02. It is attributed to STARDUST CHOLLIMA (North Korea) with medium confidence, affects Mastra AI @mastra/* npm packages (core, memory, loggers, deployer, maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1059.006), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-2294

Threat ID
TL-2026-2294
Also known as
Mini Shai-Hulud, CHAINDROP, easy-day-js Campaign, Shai-Hulud: Here We Go Again
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-09-02
Last reviewed
2026-09-02
Attribution
STARDUST CHOLLIMA
Attribution confidence
MEDIUM
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, software development, financial services, cryptocurrency, cloud services, artificial intelligence
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Open-Source Supply Chain Poisoning Campaigns Drive

Malware and tooling: CanisterWorm, Shai-Hulud, TeamPCPCloudStealer, ZshBucket

DPRK-nexus STARDUST CHOLLIMA (aka Lazarus Group/Bluenoroff) poisoned 131+ Mastra AI framework npm packages via a typosquatted dependency, and eCrime actor ALTERED SPIDER (aka TeamPCP) ran a self-propagating npm/PyPI worm that compromised 300+ dependencies in a single day. CrowdStrike responded by embedding real-time supply chain attack interception directly in the Falcon endpoint sensor.

How Open-Source Supply Chain Poisoning Campaigns Drive works

CrowdStrike's 2026 Threat Hunting Report (published 2026-08-03) named two distinct, high-volume open-source supply chain campaigns as the trigger for a new Falcon sensor capability that intercepts and quarantines poisoned package downloads before execution. On 2026-09-02, CrowdStrike detailed this endpoint-embedded protection, framing the problem around agentic AI tools (Claude Code, ChatGPT Codex, and similar coding agents) that auto-download npm/PyPI dependencies on behalf of non-developer staff, expanding the population of endpoints exposed to a poisoned install beyond traditional developer workstations.

STARDUST CHOLLIMA, a DPRK-nexus (North Korea) financially-motivated intrusion set publicly overlapping with Lazarus Group and Bluenoroff, has run at least two documented 2026 campaigns against the npm ecosystem. On 2026-03-31, the group used stolen maintainer credentials to inject the cross-platform ZshBucket implant into the widely-used axios HTTP client package (CrowdStrike attributes this with moderate confidence, citing infrastructure overlap with prior STARDUST CHOLLIMA operations as well as shared hosting with FAMOUS CHOLLIMA's InvisibleFerret malware). On 2026-06-17, over an 88-minute automated window (01:12-02:39 UTC), the group hijacked a maintainer account and republished 131-142 packages across the @mastra npm scope (a popular AI-agent framework, combined weekly downloads over 1.1M) with a single injected dependency, easy-day-js — a typosquat of the dayjs date library carrying an obfuscated postinstall dropper that fetched a second-stage payload and then deleted itself.

ALTERED SPIDER (publicly tracked as TeamPCP), an eCrime actor active since at least November 2025, escalated in 2026 to a self-propagating, credential-stealing npm/PyPI worm lineage related to the 'Shai-Hulud' family. On 2026-05-19, a wave dubbed 'Mini Shai-Hulud' compromised the @antv namespace and 300+ npm packages (128K+ weekly downloads) in a 22-minute automated burst (01:39-02:06 UTC), using a bun-executed obfuscated payload (CanisterWorm) that harvested npm tokens, GitHub PATs, SSH keys, and cloud/CI-CD credentials, then re-published itself to every package reachable with the stolen tokens and exfiltrated secrets to newly-created public GitHub repositories. A later wave (publicly reported as CHAINDROP, disclosed around 2026-08-06 and reflected in a Singapore CSA advisory) hit the keyv cache-utility monorepo and 400+ related packages (1,300+ versions, ~2B monthly downloads), adding persistence via VS Code tasks.json and Claude Code's .claude/settings.json SessionStart hook, plus C2 address resolution through an Ethereum smart-contract resolver as a takedown-resistant fallback.

A thematically related but organizationally distinct campaign, PromptMink (disclosed by ReversingLabs on 2026-04-29 and attributed to Famous Chollima, a sibling DPRK cluster also tracked as Void Dokkaebi/PurpleBravo/UNC5342), demonstrates the specific AI-agent-targeting mechanism CrowdStrike's announcement warns about: packages engineered (polished READMEs, complete TypeScript typings, binary-obfuscated payloads) to be autonomously selected and installed by LLM coding agents rather than human developers, with at least one confirmed case of an agent installing the credential-stealing dependency with no human review, prompt injection, or jailbreak involved.

MITRE ATT&CK techniques used in TL-2026-2294

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion

Execution

T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1555 Credentials from Password Stores

Persistence

T1546 Event Triggered Execution

Exfiltration

T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1588.002 Obtain Capabilities: Tool

Affected products and versions in Open-Source Supply Chain Poisoning Campaigns Drive

  • Mastra AI — @mastra/* npm packages (core, memory, loggers, deployer, client-js, and related)
    Vulnerable versions: versions republished under 'latest' tag 2026-06-17 01:12-02:39 UTC with easy-day-js dependency
    Fixed in: versions published after npm removed the poisoned releases
  • axios (axios-http) — axios npm package
    Vulnerable versions: v1.14.1 (compromised 2026-03-31)
    Fixed in: subsequent clean release after maintainer credential rotation
  • AntV (Ant Group) — @antv/g2, @antv/g6, @antv/l7, @antv/s2, @antv/x6 and related npm packages
    Vulnerable versions: 300+ package versions republished 2026-05-19 01:39-02:06 UTC
    Fixed in: versions after npm registry cleanup
  • OpenJS ecosystem (keyv maintainers) — keyv, flat-cache, file-entry-cache, cacheable-request, cacheable, cache-manager, @cacheable/memory, @cacheable/node-cache
    Vulnerable versions: keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, cache-manager 7.2.10, @cacheable/memory 2.2.1, @cacheable/node-cache 3.1.2
    Fixed in: patched versions per CSA AD-2026-009

Remediation for Open-Source Supply Chain Poisoning Campaigns Drive

Patches

  • Pin dependencies to versions predating the compromise window and verify against the npm registry's removed/deprecated version list
  • Upgrade @mastra/* packages past the 2026-06-17 compromise window once maintainers confirm remediation
  • Upgrade keyv and related @cacheable/flat-cache family packages per the CSA AD-2026-009 advisory

Immediate actions

  • Enable Falcon (or equivalent EDR) real-time supply chain attack interception to quarantine poisoned package downloads before execution
  • Search package.json/package-lock.json and requirements.txt/Pipfile.lock across all repos for easy-day-js, and for keyv/flat-cache/cacheable-request/cacheable/cache-manager/@cacheable/* versions matching the CSA advisory list
  • Rotate all developer, CI/CD, cloud (AWS/GCP/Azure), GitHub, npm, and SSH credentials on any host that ran `npm install`/`npm ci` against an affected package
  • Audit ~/.ssh/authorized_keys (Linux) and C:\Users\{USERNAME}\.ssh (Windows) for unauthorized key injections
  • Search GitHub org repositories for unexpected public repos, particularly any with 'Shai-Hulud' in the description, and revoke any GitHub PATs/tokens found exfiltrated

Workarounds

  • Temporarily disable automatic postinstall/preinstall script execution (e.g., npm config set ignore-scripts true) in CI pipelines
  • Restrict AI coding-agent tool permissions so they cannot autonomously run package-manager install commands without a human-approved allowlist

Longer-term hardening

  • Sandbox AI coding-agent package installs (microVM/container) and require human review of any AI-agent-introduced dependency before merge
  • Implement package integrity/provenance verification (e.g., Sigstore, npm provenance attestations) and dependency allowlisting
  • Deploy egress allowlisting on build/CI infrastructure to block connections to first-time-seen destinations
  • Monitor for postinstall/preinstall script execution as a detection signal, not just a build-time inconvenience

Weaknesses (CWE) in Open-Source Supply Chain Poisoning Campaigns Drive

CWE-829, CWE-494

Timeline of Open-Source Supply Chain Poisoning Campaigns Drive

  • ALTERED SPIDER (publicly tracked as TeamPCP) first observed active as an eCrime supply-chain actor.
  • IP 23.254.203.244 confirmed as STARDUST CHOLLIMA infrastructure, later reused in the Axios compromise.
  • STARDUST CHOLLIMA uses stolen maintainer credentials to inject ZshBucket malware into the axios npm package (v1.14.1), the first observed cross-platform (Windows/macOS/Linux) ZshBucket deployment.
  • ReversingLabs discloses PromptMink, a related DPRK-nexus (Famous Chollima) campaign engineering npm/PyPI packages specifically to be autonomously installed by LLM coding agents.
  • ALTERED SPIDER's Mini Shai-Hulud/CanisterWorm campaign compromises 300+ npm package versions across the @antv namespace in a 22-minute automated burst (01:39-02:06 UTC).
  • STARDUST CHOLLIMA hijacks an npm maintainer account and republishes 131-142 @mastra AI-framework packages with the easy-day-js typosquat dependency over an 88-minute window (01:12-02:39 UTC).
  • CrowdStrike publishes its 2026 Threat Hunting Report, publicly naming both the STARDUST CHOLLIMA (131 packages) and ALTERED SPIDER (300+ packages/day) campaigns.
  • A further Shai-Hulud-lineage wave (CHAINDROP) compromises the keyv monorepo and 400+ related packages (1,300+ versions); Singapore CSA issues advisory AD-2026-009.
  • CrowdStrike announces real-time supply chain attack protection embedded in the Falcon sensor, citing both named campaigns and the growing role of agentic AI tools in expanding package-download exposure.

Sources cited for Open-Source Supply Chain Poisoning Campaigns Drive

More in supply chain

Detection coverage for TL-2026-2294

As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2294 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2294

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats