Threat reportSupply ChainTL-2026-3376
Software Supply Chain Attacks: Upstream Poisoning via Registries, Maintainer Accounts and Build Pipelines (Shai-Hulud, PhantomRaven, SUNBURST)
Software Supply Chain Attacks (TL-2026-3376), also tracked as Shai-Hulud, is a high-severity supply-chain compromise, first published 2026-10-12. It has no confirmed attribution, affects npm / Node.js ecosystem npm registry packages (Shai-Hulud affected, maps to 13 MITRE ATT&CK techniques (T1036.005, T1059.007, T1071.001), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3376
- Threat ID
- TL-2026-3376
- Also known as
- Shai-Hulud, PhantomRaven, SUNBURST, Solorigate
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, government administration, cloud services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Software Supply Chain Attacks
Malware and tooling: PhantomRaven, SUNBURST, Shai-Hulud, TruffleHog - S9009
How Software Supply Chain Attacks works
Software supply chain attacks place malicious code in upstream components, tools or build processes so that it rides trust to downstream consumers. Recent examples are the Shai-Hulud self-propagating npm worm, the PhantomRaven npm credential-harvesting campaign and the 2020 SolarWinds Orion SUNBURST backdoor (up to ~18,000 downloaders).
This record provides technique-level coverage of software supply chain compromise, based on the Endor Labs explainer 'Veiled in Trust: Software Supply Chain Attacks Explained' (2026-07-13) and corroborating primary and secondary reporting on three named campaigns. The source describes the generic pattern as: find a trusted entry point, gain access, insert the payload, ride the trust downstream. Cited vectors are typosquatting, dependency confusion and malicious packages in open source registries; compromised build pipelines and signing certificates; malicious maintainer takeover via commit access; and abuse of over-permissioned third-party integrations, actions and tokens. No CVEs are associated with the source.
Shai-Hulud (CERT/CC VU#534320, disclosed 2025-09-15) is a self-propagating npm worm. A postinstall script runs a malicious bundle.js that downloads and runs TruffleHog to scan the environment for secrets (GitHub personal access tokens and AWS, GCP and Azure keys, including from CI/CD platforms such as GitHub Actions, GitLab CI and Jenkins). The stolen credentials are exfiltrated to attacker infrastructure and a public GitHub repository, then used to authenticate to npm as the compromised maintainer and publish tainted versions. More than 500 packages were affected, including a CrowdStrike npm account, and GitHub removed the compromised packages. CISA advised reviewing npm dependencies via lock files and pinning to releases produced before 2025-09-16.
PhantomRaven (Endor Labs, 'Return of PhantomRaven') abuses Remote Dynamic Dependencies (RDD): package.json declares an HTTP URL as a dependency, so npm itself fetches the real payload from an attacker server during a normal install, while the registry package contains only a benign 'Hello World' script. Slopsquatting-style names (Babel plugins, GraphQL Codegen, ESLint plugins, real person/org impersonation) are used. Wave 1 (Aug-Oct 2025) comprised 200+ packages with 86,000+ downloads; Waves 2-4 (Nov 2025-Feb 2026) added 88 packages. The 259-line payload harvests developer emails from .gitconfig, .npmrc, environment variables and package.json, detects CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI), fingerprints the host (IP, hostname, OS, Node version) and exfiltrates over HTTP GET, HTTP POST and a WebSocket fallback using a spoofed Windows Chrome User-Agent. Infrastructure is consistent across waves: 'artifact'-themed domains on AWS EC2, registered via Amazon Registrar, Route 53 nameservers, no TLS, PHP endpoints (jpd.php, npm.php) and a hardcoded 'JPD' author field in C2-served tarballs, pointing to a single operator.
SUNBURST (2020) compromised the SolarWinds Orion build pipeline. A trojanized, digitally signed SolarWinds.Orion.Core.BusinessLayer.dll was delivered via a Windows Installer Patch (SolarWinds-Core-v2019.4.5220-Hotfix5.msp) and contacted avsvmcloud.com to download additional payloads. SolarWinds stated that no more than 18,000 of its 300,000 customers downloaded the malicious update, including US federal agencies. Unit 42 tracks the actor as SolarStorm (UNC2452).
Severity HIGH is an analyst assessment; the source gives no CVSS score. Defensive priorities from the source: generate SBOMs (CycloneDX/SPDX) in CI/CD on every build, detect malware before the build phase, harden pipelines (hermetic builds, ephemeral environments, signed commits), pin versions with lock files, enforce least privilege, and maintain incident response plans.
MITRE ATT&CK techniques used in TL-2026-3376
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Execution
T1059.007 JavaScript; T1204.005 Malicious Library
Command and Control
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Discovery
T1082 System Information Discovery
Credential Access
T1552.001 Credentials In Files
defense-impairment
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in Software Supply Chain Attacks
- npm / Node.js ecosystem — npm registry packages (Shai-Hulud affected 500+ packages; PhantomRaven 200+ in Wave 1 plus 88 in Waves 2-4)
Vulnerable versions: Packages published or tainted by Shai-Hulud after 2025-09-16; PhantomRaven packages, e.g. transform-react-jsx, jam3, google-camelcase, sort-export-all
Fixed in: Releases produced before 2025-09-16 (per CISA guidance) - SolarWinds — Orion Platform (SolarWinds-Core-v2019.4.5220-Hotfix5)
Vulnerable versions: Trojanized SolarWinds.Orion.Core.BusinessLayer.dll delivered in Hotfix 5 MSP
Remediation for Software Supply Chain Attacks
Patches
- No CVE or vendor patch applies; remove affected package versions and replace them with known-good releases
Immediate actions
- Review npm dependencies, including transitive ones, via lock files and search artifact repositories for cached copies of affected versions
- Pin to known-good releases produced before 2025-09-16 for packages affected by Shai-Hulud
- Rotate all developer and CI/CD credentials (GitHub PATs, npm tokens, cloud keys) that may have been exposed
- Block egress to known PhantomRaven C2 domains and IPs and alert on npm installs fetching HTTP URL dependencies
- Install with npm install --ignore-scripts where lifecycle scripts are not required
Workarounds
- Enforce version pinning and lock files
- Disallow non-registry (HTTP URL) dependencies in package.json through policy or registry proxy controls
Longer-term hardening
- Generate SBOMs (CycloneDX or SPDX) in CI/CD on every build
- Deploy malware detection on dependencies before the build phase
- Harden build pipelines with hermetic builds, ephemeral environments and signed commits
- Enforce least-privilege, scoped tokens and phishing-resistant MFA on developer platforms
- Use internal registries or proxies (Verdaccio, Artifactory) and monitor for anomalous egress from build systems
- Maintain and exercise an incident response plan for supply chain compromise
Weaknesses (CWE) in Software Supply Chain Attacks
Timeline of Software Supply Chain Attacks
- SUNBURST backdoor in trojanized SolarWinds Orion update disclosed; CISA issued an emergency directive. SolarWinds later said no more than 18,000 of 300,000 customers downloaded the malicious update.
- PhantomRaven Wave 1 C2 domain packages.storeartifact.com registered; Wave 1 ran Aug-Oct 2025 with 200+ packages and 86,000+ downloads.
- Shai-Hulud self-propagating npm worm disclosed (CERT/CC VU#534320); 500+ packages compromised via stolen maintainer credentials, GitHub removed the affected packages.
- Koi Security disclosed PhantomRaven Wave 1 (126 packages).
- Sonatype identified 83 additional Wave 1 PhantomRaven packages.
- PhantomRaven Wave 2 C2 domain npm.jpartifacts.com registered.
- First Wave 2 package (transform-react-jsx) published; Wave 2 totalled 50 packages through 2026-02-10.
- Wave 3 C2 package.storeartifacts.com registered and first packages published; 34 packages through 2026-02-17.
- Wave 4 C2 npm.artifactsnpm.com registered and all four Wave 4 packages published the same day.
- Endor Labs published 'Veiled in Trust: Software Supply Chain Attacks Explained', citing Shai-Hulud, PhantomRaven and SUNBURST.
Sources cited for Software Supply Chain Attacks
- Veiled in Trust: Software Supply Chain Attacks Explained
- Return of PhantomRaven (Endor Labs)
- CERT/CC VU#534320: Shai-Hulud npm supply chain attack
- CISA urges orgs to review software after Shai-Hulud supply chain compromise (The Record)
- PhantomRaven returns to npm with 88 bad packages (CSO Online)
- New PhantomRaven npm attack wave steals dev data via 88 packages (BleepingComputer)
- CSA Research Note: PhantomRaven npm Campaign: Developer Credential Theft at Scale
- Mend: PhantomRaven Wave 5 undocumented npm supply chain campaign
- Unit 42: SolarStorm / SUNBURST (FireEye breach)
- Qualys: FireEye Breach Leveraged SolarWinds Orion Software
- McAfee: SUNBURST Malware and SolarWinds Supply Chain Compromise
Detection coverage for TL-2026-3376
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3376 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3376
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.