# Software Supply Chain Attacks: Upstream Poisoning via Registries, Maintainer Accounts and Build Pipelines (Shai-Hulud, PhantomRaven, SUNBURST)

> Software supply chain attacks place malicious code in upstream components, tools or build processes so that it rides trust to downstream consumers. Recent examples are the Shai-Hulud self-propagating npm worm, the PhantomRaven npm credential-harvesting campaign and the 2020 SolarWinds Orion SUNBURST backdoor (up to ~18,000 downloaders).

- **Published:** 2026-10-12T22:40:09Z
- **Last reviewed:** 2026-10-12T22:40:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3376
- **ID:** TL-2026-3376
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record provides technique-level coverage of software supply chain compromise, based on the Endor Labs explainer 'Veiled in Trust: Software Supply Chain Attacks Explained' (2026-07-13) and corroborating primary and secondary reporting on three named campaigns. The source describes the generic pattern as: find a trusted entry point, gain access, insert the payload, ride the trust downstream. Cited vectors are typosquatting, dependency confusion and malicious packages in open source registries; compromised build pipelines and signing certificates; malicious maintainer takeover via commit access; and abuse of over-permissioned third-party integrations, actions and tokens. No CVEs are associated with the source.

Shai-Hulud (CERT/CC VU#534320, disclosed 2025-09-15) is a self-propagating npm worm. A postinstall script runs a malicious bundle.js that downloads and runs TruffleHog to scan the environment for secrets (GitHub personal access tokens and AWS, GCP and Azure keys, including from CI/CD platforms such as GitHub Actions, GitLab CI and Jenkins). The stolen credentials are exfiltrated to attacker infrastructure and a public GitHub repository, then used to authenticate to npm as the compromised maintainer and publish tainted versions. More than 500 packages were affected, including a CrowdStrike npm account, and GitHub removed the compromised packages. CISA advised reviewing npm dependencies via lock files and pinning to releases produced before 2025-09-16.

PhantomRaven (Endor Labs, 'Return of PhantomRaven') abuses Remote Dynamic Dependencies (RDD): package.json declares an HTTP URL as a dependency, so npm itself fetches the real payload from an attacker server during a normal install, while the registry package contains only a benign 'Hello World' script. Slopsquatting-style names (Babel plugins, GraphQL Codegen, ESLint plugins, real person/org impersonation) are used. Wave 1 (Aug-Oct 2025) comprised 200+ packages with 86,000+ downloads; Waves 2-4 (Nov 2025-Feb 2026) added 88 packages. The 259-line payload harvests developer emails from .gitconfig, .npmrc, environment variables and package.json, detects CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI), fingerprints the host (IP, hostname, OS, Node version) and exfiltrates over HTTP GET, HTTP POST and a WebSocket fallback using a spoofed Windows Chrome User-Agent. Infrastructure is consistent across waves: 'artifact'-themed domains on AWS EC2, registered via Amazon Registrar, Route 53 nameservers, no TLS, PHP endpoints (jpd.php, npm.php) and a hardcoded 'JPD' author field in C2-served tarballs, pointing to a single operator.

SUNBURST (2020) compromised the SolarWinds Orion build pipeline. A trojanized, digitally signed SolarWinds.Orion.Core.BusinessLayer.dll was delivered via a Windows Installer Patch (SolarWinds-Core-v2019.4.5220-Hotfix5.msp) and contacted avsvmcloud.com to download additional payloads. SolarWinds stated that no more than 18,000 of its 300,000 customers downloaded the malicious update, including US federal agencies. Unit 42 tracks the actor as SolarStorm (UNC2452).

Severity HIGH is an analyst assessment; the source gives no CVSS score. Defensive priorities from the source: generate SBOMs (CycloneDX/SPDX) in CI/CD on every build, detect malware before the build phase, harden pipelines (hermetic builds, ephemeral environments, signed commits), pin versions with lock files, enforce least privilege, and maintain incident response plans.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1204.005 Malicious Library
- T1553.002 Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service

## Sources

- [Veiled in Trust: Software Supply Chain Attacks Explained](https://www.endorlabs.com/learn/veiled-in-trust-software-supply-chain-attacks-explained)
- [Return of PhantomRaven (Endor Labs)](https://www.endorlabs.com/learn/return-of-phantomraven)
- [CERT/CC VU#534320: Shai-Hulud npm supply chain attack](https://kb.cert.org/vuls/id/534320)
- [CISA urges orgs to review software after Shai-Hulud supply chain compromise (The Record)](https://therecord.media/cisa-urges-software-reviews-malicious-packages)
- [PhantomRaven returns to npm with 88 bad packages (CSO Online)](https://www.csoonline.com/article/4144231/phantomraven-returns-to-npm-with-88-bad-packages.html)
- [New PhantomRaven npm attack wave steals dev data via 88 packages (BleepingComputer)](https://bleepingcomputer.com/news/security/new-phantomraven-npm-attack-wave-steals-dev-data-via-88-packages)
- [CSA Research Note: PhantomRaven npm Campaign: Developer Credential Theft at Scale](https://labs.cloudsecurityalliance.org/research/csa-research-note-phantomraven-npm-dev-credential-theft-2026/)
- [Mend: PhantomRaven Wave 5 undocumented npm supply chain campaign](https://www.mend.io/blog/phantomraven-wave-5-new-undocumented-npm-supply-chain-campaign-targets-defi-cloud-and-ai-developers)
- [Unit 42: SolarStorm / SUNBURST (FireEye breach)](https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/)
- [Qualys: FireEye Breach Leveraged SolarWinds Orion Software](https://blog.qualys.com/vulnerabilities-threat-research/2020/12/14/fireeye-breach-leveraged-solarwinds-orion-software)
- [McAfee: SUNBURST Malware and SolarWinds Supply Chain Compromise](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/sunburst-malware-and-solarwinds-supply-chain-compromise/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3376