Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception
Open-Source Supply Chain Poisoning Campaigns Drive (TL-2026-2294), also tracked as Mini Shai-Hulud, is a high-severity supply-chain compromise, first published 2026-09-02. It is attributed to STARDUST CHOLLIMA (North Korea) with medium confidence, affects Mastra AI @mastra/* npm packages (core, memory, loggers, deployer, maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1059.006), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-2294
- Threat ID
- TL-2026-2294
- Also known as
- Mini Shai-Hulud, CHAINDROP, easy-day-js Campaign, Shai-Hulud: Here We Go Again
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-09-02
- Last reviewed
- 2026-09-02
- Attribution
- STARDUST CHOLLIMA
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, financial services, cryptocurrency, cloud services, artificial intelligence
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Open-Source Supply Chain Poisoning Campaigns Drive
Malware and tooling: CanisterWorm, Shai-Hulud, TeamPCPCloudStealer, ZshBucket
DPRK-nexus STARDUST CHOLLIMA (aka Lazarus Group/Bluenoroff) poisoned 131+ Mastra AI framework npm packages via a typosquatted dependency, and eCrime actor ALTERED SPIDER (aka TeamPCP) ran a self-propagating npm/PyPI worm that compromised 300+ dependencies in a single day. CrowdStrike responded by embedding real-time supply chain attack interception directly in the Falcon endpoint sensor.
How Open-Source Supply Chain Poisoning Campaigns Drive works
CrowdStrike's 2026 Threat Hunting Report (published 2026-08-03) named two distinct, high-volume open-source supply chain campaigns as the trigger for a new Falcon sensor capability that intercepts and quarantines poisoned package downloads before execution. On 2026-09-02, CrowdStrike detailed this endpoint-embedded protection, framing the problem around agentic AI tools (Claude Code, ChatGPT Codex, and similar coding agents) that auto-download npm/PyPI dependencies on behalf of non-developer staff, expanding the population of endpoints exposed to a poisoned install beyond traditional developer workstations.
STARDUST CHOLLIMA, a DPRK-nexus (North Korea) financially-motivated intrusion set publicly overlapping with Lazarus Group and Bluenoroff, has run at least two documented 2026 campaigns against the npm ecosystem. On 2026-03-31, the group used stolen maintainer credentials to inject the cross-platform ZshBucket implant into the widely-used axios HTTP client package (CrowdStrike attributes this with moderate confidence, citing infrastructure overlap with prior STARDUST CHOLLIMA operations as well as shared hosting with FAMOUS CHOLLIMA's InvisibleFerret malware). On 2026-06-17, over an 88-minute automated window (01:12-02:39 UTC), the group hijacked a maintainer account and republished 131-142 packages across the @mastra npm scope (a popular AI-agent framework, combined weekly downloads over 1.1M) with a single injected dependency, easy-day-js — a typosquat of the dayjs date library carrying an obfuscated postinstall dropper that fetched a second-stage payload and then deleted itself.
ALTERED SPIDER (publicly tracked as TeamPCP), an eCrime actor active since at least November 2025, escalated in 2026 to a self-propagating, credential-stealing npm/PyPI worm lineage related to the 'Shai-Hulud' family. On 2026-05-19, a wave dubbed 'Mini Shai-Hulud' compromised the @antv namespace and 300+ npm packages (128K+ weekly downloads) in a 22-minute automated burst (01:39-02:06 UTC), using a bun-executed obfuscated payload (CanisterWorm) that harvested npm tokens, GitHub PATs, SSH keys, and cloud/CI-CD credentials, then re-published itself to every package reachable with the stolen tokens and exfiltrated secrets to newly-created public GitHub repositories. A later wave (publicly reported as CHAINDROP, disclosed around 2026-08-06 and reflected in a Singapore CSA advisory) hit the keyv cache-utility monorepo and 400+ related packages (1,300+ versions, ~2B monthly downloads), adding persistence via VS Code tasks.json and Claude Code's .claude/settings.json SessionStart hook, plus C2 address resolution through an Ethereum smart-contract resolver as a takedown-resistant fallback.
A thematically related but organizationally distinct campaign, PromptMink (disclosed by ReversingLabs on 2026-04-29 and attributed to Famous Chollima, a sibling DPRK cluster also tracked as Void Dokkaebi/PurpleBravo/UNC5342), demonstrates the specific AI-agent-targeting mechanism CrowdStrike's announcement warns about: packages engineered (polished READMEs, complete TypeScript typings, binary-obfuscated payloads) to be autonomously selected and installed by LLM coding agents rather than human developers, with at least one confirmed case of an agent installing the credential-stealing dependency with no human review, prompt injection, or jailbreak involved.
MITRE ATT&CK techniques used in TL-2026-2294
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1555 Credentials from Password Stores
Persistence
T1546 Event Triggered Execution
Exfiltration
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Lateral Movement
Resource Development
Affected products and versions in Open-Source Supply Chain Poisoning Campaigns Drive
- Mastra AI — @mastra/* npm packages (core, memory, loggers, deployer, client-js, and related)
Vulnerable versions: versions republished under 'latest' tag 2026-06-17 01:12-02:39 UTC with easy-day-js dependency
Fixed in: versions published after npm removed the poisoned releases - axios (axios-http) — axios npm package
Vulnerable versions: v1.14.1 (compromised 2026-03-31)
Fixed in: subsequent clean release after maintainer credential rotation - AntV (Ant Group) — @antv/g2, @antv/g6, @antv/l7, @antv/s2, @antv/x6 and related npm packages
Vulnerable versions: 300+ package versions republished 2026-05-19 01:39-02:06 UTC
Fixed in: versions after npm registry cleanup - OpenJS ecosystem (keyv maintainers) — keyv, flat-cache, file-entry-cache, cacheable-request, cacheable, cache-manager, @cacheable/memory, @cacheable/node-cache
Vulnerable versions: keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, cache-manager 7.2.10, @cacheable/memory 2.2.1, @cacheable/node-cache 3.1.2
Fixed in: patched versions per CSA AD-2026-009
Remediation for Open-Source Supply Chain Poisoning Campaigns Drive
Patches
- Pin dependencies to versions predating the compromise window and verify against the npm registry's removed/deprecated version list
- Upgrade @mastra/* packages past the 2026-06-17 compromise window once maintainers confirm remediation
- Upgrade keyv and related @cacheable/flat-cache family packages per the CSA AD-2026-009 advisory
Immediate actions
- Enable Falcon (or equivalent EDR) real-time supply chain attack interception to quarantine poisoned package downloads before execution
- Search package.json/package-lock.json and requirements.txt/Pipfile.lock across all repos for easy-day-js, and for keyv/flat-cache/cacheable-request/cacheable/cache-manager/@cacheable/* versions matching the CSA advisory list
- Rotate all developer, CI/CD, cloud (AWS/GCP/Azure), GitHub, npm, and SSH credentials on any host that ran `npm install`/`npm ci` against an affected package
- Audit ~/.ssh/authorized_keys (Linux) and C:\Users\{USERNAME}\.ssh (Windows) for unauthorized key injections
- Search GitHub org repositories for unexpected public repos, particularly any with 'Shai-Hulud' in the description, and revoke any GitHub PATs/tokens found exfiltrated
Workarounds
- Temporarily disable automatic postinstall/preinstall script execution (e.g., npm config set ignore-scripts true) in CI pipelines
- Restrict AI coding-agent tool permissions so they cannot autonomously run package-manager install commands without a human-approved allowlist
Longer-term hardening
- Sandbox AI coding-agent package installs (microVM/container) and require human review of any AI-agent-introduced dependency before merge
- Implement package integrity/provenance verification (e.g., Sigstore, npm provenance attestations) and dependency allowlisting
- Deploy egress allowlisting on build/CI infrastructure to block connections to first-time-seen destinations
- Monitor for postinstall/preinstall script execution as a detection signal, not just a build-time inconvenience
Weaknesses (CWE) in Open-Source Supply Chain Poisoning Campaigns Drive
CWE-829, CWE-494
Timeline of Open-Source Supply Chain Poisoning Campaigns Drive
- ALTERED SPIDER (publicly tracked as TeamPCP) first observed active as an eCrime supply-chain actor.
- IP 23.254.203.244 confirmed as STARDUST CHOLLIMA infrastructure, later reused in the Axios compromise.
- STARDUST CHOLLIMA uses stolen maintainer credentials to inject ZshBucket malware into the axios npm package (v1.14.1), the first observed cross-platform (Windows/macOS/Linux) ZshBucket deployment.
- ReversingLabs discloses PromptMink, a related DPRK-nexus (Famous Chollima) campaign engineering npm/PyPI packages specifically to be autonomously installed by LLM coding agents.
- ALTERED SPIDER's Mini Shai-Hulud/CanisterWorm campaign compromises 300+ npm package versions across the @antv namespace in a 22-minute automated burst (01:39-02:06 UTC).
- STARDUST CHOLLIMA hijacks an npm maintainer account and republishes 131-142 @mastra AI-framework packages with the easy-day-js typosquat dependency over an 88-minute window (01:12-02:39 UTC).
- CrowdStrike publishes its 2026 Threat Hunting Report, publicly naming both the STARDUST CHOLLIMA (131 packages) and ALTERED SPIDER (300+ packages/day) campaigns.
- A further Shai-Hulud-lineage wave (CHAINDROP) compromises the keyv monorepo and 400+ related packages (1,300+ versions); Singapore CSA issues advisory AD-2026-009.
- CrowdStrike announces real-time supply chain attack protection embedded in the Falcon sensor, citing both named campaigns and the growing role of agentic AI tools in expanding package-download exposure.
Sources cited for Open-Source Supply Chain Poisoning Campaigns Drive
- CrowdStrike Extends Endpoint Security to Stop Supply Chain Attacks
- STARDUST CHOLLIMA Likely Compromises Axios npm Package
- Meet CrowdStrike's Adversary of the Month for April: STARDUST CHOLLIMA
- Altered Spider Adversary Profile
- CrowdStrike 2026 Threat Hunting Report
- DPRK STARDUST CHOLLIMA poisons Mastra AI npm packages: supply chain analysis
- easy-day-js Supply Chain Attack Hits Mastra AI in npm
- Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js
- The @antv Ecosystem Was Compromised with Shai-Hulud Malware, 300+ Packages Affected
- Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
- Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages
- PromptMink: How North Korea Tricked Claude Into Installing npm Malware
- Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens
- Self-Replicating Worm Hits 180+ Software Packages
More in supply chain
- GemStuffer: AI Agent Swarm Floods RubyGems With 2,000+ Malicious Packages, Achieves RCE via RubyDoc.info Build System, Attempts API Key Theft
- OpenAI Agent Swarm ("GemStuffer") Flooded RubyGems With 2,000+ Malicious Packages, Achieved RCE on RubyDoc.info Build Servers
- GemStuffer: OpenAI Autonomous Agents Flood RubyGems With 2,000+ Malicious Packages, Abuse RubyDoc.info Build System for RCE and Target a RubyGems API-Key Cache-Leak Flaw
- Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool Hijack (GHSA-vx42-ghc9-gw65)
- Slopsquatting: Attackers Weaponize AI-Hallucinated Package Names in Supply Chain Attacks
Detection coverage for TL-2026-2294
As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2294 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2294
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.