# Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)

> StepSecurity catalogs the malicious files that software supply chain campaigns leave in GitHub repositories and on developer machines, including .claude/settings.json SessionStart hooks, .vscode/tasks.json autorun tasks, .github/setup.js worm loaders, obfuscated code appended to setup.py/main.py, binding.gyp entries and Cursor rule files. Named campaigns include Miasma, Mini Shai-Hulud, ForceMemo, Megalodon (5,561 repositories), GhostAction (817 repositories), TeamPCP (Trivy), the Axios npm compromise, s1ngularity (Nx) and the Hades PyPI wave.

- **Published:** 2026-11-04T02:59:04Z
- **Last reviewed:** 2026-11-04T02:59:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5205
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5205.png
- **ID:** TL-2026-5205
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** GlassWorm
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

This record consolidates a StepSecurity catalog (published 2026-11-03) of file-based artifacts that software supply chain campaigns leave behind in GitHub repositories, branches, pull requests, tags and on developer machines, together with primary-source reporting on each named campaign. The catalog is intended for hunting and detection: filename patterns (for example **/binding.gyp, **/.github/setup.js) combined with multi-check content analysis (StepSecurity rule miasma-ide-autorun-github-setup-js uses 5 checks, 3 required).

Miasma (Mini Shai-Hulud derivative): on 2026-06-05 a recompromised contributor account pushed commit 5f456b8 to Azure/durabletask with a backdated author timestamp (2020-03-09) and message 'Switched DataConverter to OrchestrationContext [skip ci]'. The commit changed no source code and added five files: .claude/settings.json and .gemini/settings.json (SessionStart hooks), .cursor/rules/setup.mdc (prompt injection), .vscode/tasks.json (folderOpen task) and .github/setup.js (a ~4.6 MB single-line obfuscated JavaScript credential harvester). The payload runs when the folder is opened in Claude Code, Gemini CLI, Cursor or VS Code, not at install time. It targets GitHub PATs and Actions secrets, npm/PyPI/RubyGems/JFrog/CircleCI/Anthropic tokens, AWS/GCP/Azure/Kubernetes/Vault credentials, .env, .npmrc, .pypirc, SSH keys and shell history, and uses Bun downloaded from GitHub releases as a runtime. Earlier Miasma waves (June 1 and June 4) delivered via npm preinstall and binding.gyp; a Hades wave on June 7 dropped 37 malicious wheels across 19 PyPI packages. GitHub disabled 73 Microsoft repositories in a ~2.5-minute sweep. Mini Shai-Hulud (May 2026) installs SessionStart and VS Code task persistence that survives reboots.

ForceMemo (GlassWorm offshoot): attackers use GitHub tokens stolen by GlassWorm-infected VS Code/Cursor extensions to take over accounts, rebase the latest commit with obfuscated malware appended to setup.py, main.py, app.py and similar files, and force-push while preserving the original message, author and date. The payload resolves its payload server via a Solana wallet memo (dead-drop resolver) and persists via ~/init.json.

Megalodon: on 2026-05-18 5,718 commits across 5,561 repositories in about six hours added or replaced GitHub Actions workflows (SysDiag.yml, Optimize-Build.yml, ci.yml) under forged build-bot identities; the payload gzips harvested CI secrets and cloud credentials and POSTs them to 216.126.225.129:8443/collect. Some workflows use workflow_dispatch to create dormant backdoors. GhostAction (disclosed 2025-09-05 by GitGuardian): 327 compromised accounts pushed a 'Github Actions Security' workflow to 817 repositories that exfiltrated 3,325 secrets to a plesk.page host. TeamPCP: on 2026-03-19 Trivy and trivy-action/setup-trivy were compromised after a pull_request_target misconfiguration leaked a PAT; the multi-stage stealer reads Runner.Worker process memory, encrypts with AES-256-CBC/RSA-4096 and exfiltrates to a typosquatted domain, with a tpcp-docs fallback repository and an ICP canister for secondary C2. Axios: axios@1.14.1 and axios@0.30.4 added the dependency plain-crypto-js@4.2.1 whose postinstall dropped a cross-platform RAT (Microsoft attributes to Sapphire Sleet). s1ngularity (Nx, 2025-08-26): malicious Nx versions ran telemetry.js, which abused installed AI CLIs (Claude, Gemini, Q) with permission-bypass flags to find secrets and published them to public s1ngularity-repository repositories.

No CVEs are assigned: these are account-takeover, CI misconfiguration and malicious-package campaigns (CWE-829, CWE-506). Attribution is campaign-specific and mostly low confidence; Miasma is linked to TeamPCP by a single vendor.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1059.006 Python
- T1059.004 Unix Shell
- T1546 Event Triggered Execution
- T1543.002 Systemd Service
- T1027 Obfuscated Files or Information
- T1070.006 Timestomp
- T1036 Masquerading
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1003.007 Proc Filesystem
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Miasma .github/setup.js Loader Executed by Node.js or Bun - Exploitation** (`TL-2026-5205-SPL-001`)

Detects node.exe/bun.exe executing the repository-supplied .github/setup.js, the ~4.6 MB obfuscated JavaScript credential harvester planted by Miasma (commit 5f456b8 on Azure/durabletask) and Mini Shai-Hulud. The payload fires when a poisoned folder is opened in Claude Code, Gemini CLI, Cursor or VS Code rather than at install time, so IDE/agent parentage raises severity to critical.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.007, T1546, T1027
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*node.exe" OR Image="*bun.exe") CommandLine="*.github*setup.js*"
```comment: Miasma / Mini Shai-Hulud loader - Node.js or Bun executing the repository-supplied .github/setup.js (about 4.6 MB single-line obfuscated JavaScript) after a folder is opened in VS Code, Cursor, Claude Code or Gemini CLI```
| eval ide_parent=if(like(lower(ParentImage),"%code.exe") OR like(lower(ParentImage),"%cursor.exe") OR like(lower(ParentImage),"%claude%") OR like(lower(ParentImage),"%gemini%"),"yes","no")
| stats count as exec_count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(ide_parent) as launched_by_ide_or_agent by host User Image
| eval severity=if(isnotnull(mvfind(launched_by_ide_or_agent,"yes")),"critical","high")
| convert ctime(first_seen) ctime(last_seen)
| table host User Image command_lines parent_images launched_by_ide_or_agent exec_count first_seen last_seen severity
````

### Microsoft KQL

```kql
// Miasma .github/setup.js loader executed by Node.js or Bun (IDE / AI-agent autorun)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node", "node.exe", "bun", "bun.exe")
| where ProcessCommandLine matches regex @"(?i)[.]github.setup[.]js"
| extend LaunchedByIdeOrAgent = InitiatingProcessFileName in~ ("code", "code.exe", "cursor", "cursor.exe", "claude", "claude.exe", "gemini", "gemini.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, LaunchedByIdeOrAgent, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Node.js or Bun Executing Repository .github/setup.js Loader
id: 3f6b2d1e-8a47-4c1d-9b52-1e7a5c0d4f01
status: experimental
description: Detects node or bun running a .github/setup.js file, the Miasma / Mini Shai-Hulud obfuscated credential-harvester loader that SessionStart hooks, VS Code folderOpen tasks and Cursor rules invoke when a poisoned repository is opened.
references:
  - https://www.stepsecurity.io/blog/malicious-files-find-what-supply-chain-attacks-leave-behind-in-your-github-repositories-and-on-developer-machines
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.persistence
  - attack.t1546
logsource:
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/node'
      - '\node.exe'
      - '/bun'
      - '\bun.exe'
  selection_cli:
    CommandLine|contains:
      - '.github/setup.js'
      - '.github\setup.js'
  condition: all of selection_*
falsepositives:
  - Repositories that legitimately ship a .github/setup.js bootstrap script
  - Developers testing StepSecurity-style detection content
level: high
```

**Known false positives:**

- Repositories that legitimately ship a .github/setup.js bootstrap script run by a developer
- Security teams reproducing the StepSecurity miasma-ide-autorun-github-setup-js rule on a lab host

**Tuning notes:** Allow-list internal repositories that intentionally contain .github/setup.js by repo path. Keep the IDE/agent parent flag as the critical-severity discriminator. On macOS/Linux fleets run the KQL or Sigma variant against EDR process telemetry; Sysmon for Windows is the SPL source here.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Supply Chain Autorun Artifacts Planted in Repository (AI Agent Hooks, VS Code Tasks, setup.js, Megalodon Workflows) - Exploitation (locked: unlock with TL Creds)
- Bun Staging, Runner.Worker Memory Scraping and Persistence on Developer/CI Hosts - Post-Exploitation (locked: unlock with TL Creds)
- Script Interpreter Dead-Drop and Tunnel C2 (Solana, ICP, Cloudflare) - C2 (locked: unlock with TL Creds)
- Malicious Package Install - axios plain-crypto-js and Hades PyPI Wheels - Exploitation (locked: unlock with TL Creds)
- AI Coding CLI Abused with Permission-Bypass Flags from npm Lifecycle Script (s1ngularity) - Post-Exploitation (locked: unlock with TL Creds)
- GitHub Exfiltration Repository Created (tpcp-docs, s1ngularity-repository) - C2/Exfiltration (locked: unlock with TL Creds)
- Developer Machine Persistence and Staging Artifacts (TeamPCP, Miasma, ForceMemo) - Post-Exploitation (locked: unlock with TL Creds)
- Egress to Supply Chain Campaign C2 and Exfiltration Infrastructure - C2/Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `216.126.225[.]129`
- Domain: `bold-dhawan[.]45-139-104-115[.]plesk[.]page`
- File hash: `c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [StepSecurity: Malicious Files - Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines](https://www.stepsecurity.io/blog/malicious-files-find-what-supply-chain-attacks-leave-behind-in-your-github-repositories-and-on-developer-machines)
- [StepSecurity: Megalodon - Mass GitHub Actions Secret Exfiltration Across 5,500 Public Repositories](https://stepsecurity.io/blog/megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories)
- [SecurityWeek: Over 5,500 GitHub Repositories Infected in Megalodon Supply Chain Attack](https://www.securityweek.com/over-5500-github-repositories-infected-in-megalodon-supply-chain-attack/)
- [StepSecurity: ForceMemo - Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push](https://www.stepsecurity.io/blog/forcememo-hundreds-of-github-python-repos-compromised-via-account-takeover-and-force-push)
- [The Hacker News: GlassWorm Attack Uses Stolen GitHub Tokens (ForceMemo)](https://thehackernews.com/2026/03/glassworm-attack-uses-stolen-github.html)
- [Phoenix Security: Miasma Worm Reaches Microsoft Azure and PyPI - 73 Repositories Disabled, Hades Wave Drops 37 Malicious Python Wheels](https://phoenix.security/miasma-azure-hades-pypi-supply-chain-worm-2026/)
- [Hive Security: Miasma and Mini Shai-Hulud AI agent supply chain 2026](https://hivesecurity.gitlab.io/blog/miasma-mini-shai-hulud-ai-agent-supply-chain-2026/)
- [DEV Community: 639 npm packages compromised in 39 minutes - malware installs a Claude Code SessionStart hook](https://dev.to/piiiico/639-npm-packages-compromised-in-39-minutes-the-malware-installs-a-claude-code-sessionstart-hook-3k38)
- [GitGuardian: GhostAction Campaign - 3,325 Secrets Stolen](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/)
- [StepSecurity: GhostAction Campaign - Over 3,000 Secrets Stolen Through Malicious GitHub Workflows](https://www.stepsecurity.io/blog/ghostaction-campaign-over-3-000-secrets-stolen-through-malicious-github-workflows)
- [Wiz: Trivy Compromised - Everything You Need to Know about the Latest Supply Chain Attack (TeamPCP)](https://wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack)
- [BleepingComputer: Trivy vulnerability scanner breach pushed infostealer via GitHub Actions](https://www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/)
- [Cloud Security Alliance: TeamPCP CI/CD Security Tool Supply Chain Compromise](https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-cicd-supply-chain-20260325/)
- [RH-ISAC: Axios npm Package Compromised to Deliver Remote Access Trojan](https://rhisac.org/threat-intelligence/axios-npm-package-compromised-to-deliver-remote-access-trojan/)
- [BleepingComputer: AI-powered malware hit 2,180 GitHub accounts in s1ngularity attack](https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5205