Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer

Key facts for Software supply chain attacks

Detection coverage for Software supply chain attacks

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5509 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shai-Hulud npm Worm Lifecycle Script and TruffleHog Execution

Detects node/bun executing the Shai-Hulud payload files setup_bun.js, bun_environment.js or bundle.js under an npm lifecycle script, and TruffleHog launched by node/bun/shell, which the worm uses to harvest GitHub, npm and cloud secrets from developer and CI hosts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1059.007, T1552.001
• Data sources: sysmon, DeviceProcessEvents, process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (((Image="*node.exe" OR Image="*bun.exe" OR Image="*/node" OR Image="*/bun") AND (CommandLine="*setup_bun.js*" OR CommandLine="*bun_environment.js*" OR (CommandLine="*bundle.js*" AND ParentCommandLine="*npm*"))) OR (Image="*trufflehog*" AND (ParentImage="*node.exe" OR ParentImage="*bun.exe" OR ParentImage="*/node" OR ParentImage="*/bun" OR ParentImage="*/sh" OR ParentImage="*/bash")))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ('node','node.exe','bun','bun.exe') and (ProcessCommandLine contains 'setup_bun.js' or ProcessCommandLine contains 'bun_environment.js' or (ProcessCommandLine contains 'bundle.js' and InitiatingProcessCommandLine has_any ('npm','pnpm','yarn'))))
    or (FileName in~ ('trufflehog','trufflehog.exe') and InitiatingProcessFileName in~ ('node','node.exe','bun','bun.exe','sh','bash'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: Shai-Hulud npm Worm Lifecycle Script and TruffleHog Execution
id: b4a2d3e5-6c7f-4a81-9ba2-1d3e4f5a6b72
status: experimental
description: Detects execution of Shai-Hulud payload files (setup_bun.js, bun_environment.js, bundle.js under npm) and TruffleHog launched by node or bun for secret harvesting.
references:
    - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1059.007
    - attack.credential-access
    - attack.t1552.001
    - attack.tool.trufflehog
logsource:
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - 'node.exe'
            - 'bun.exe'
            - '/node'
            - '/bun'
    selection_loader:
        CommandLine|contains:
            - 'setup_bun.js'
            - 'bun_environment.js'
    selection_bundle:
        CommandLine|contains: 'bundle.js'
        ParentCommandLine|contains:
            - 'npm'
            - 'pnpm'
            - 'yarn'
    selection_trufflehog:
        Image|contains: 'trufflehog'
        ParentImage|endswith:
            - 'node.exe'
            - 'bun.exe'
            - '/node'
            - '/bun'
            - '/sh'
            - '/bash'
    condition: (selection_img and (selection_loader or selection_bundle)) or selection_trufflehog
falsepositives:
    - Developers legitimately running TruffleHog from a Node-based wrapper
    - Projects that ship a build artifact named bundle.js and run it from an npm script
level: high

Known false positives:

• Developers legitimately running TruffleHog from a Node-based wrapper
• Projects that ship a build artifact named bundle.js and run it from an npm script

Tuning notes: Drop the bundle.js branch on build servers that legitimately run webpack output. Allowlist sanctioned secret-scanning pipelines by parent command line. Correlate hits with the npm install that preceded them and rotate every secret reachable from the host.

• 🔒 SUNBURST Trojanized SolarWinds Orion Component and Orion Host Shell Spawn · unlock with TL Creds
• 🔒 Codecov Bash Uploader Environment and Git Remote Exfiltration via curl · unlock with TL Creds
• 🔒 Network Contact with Codecov and MOVEit Campaign IPs · unlock with TL Creds
• 🔒 Shai-Hulud Malicious GitHub Workflow and Payload File Creation · unlock with TL Creds
• 🔒 Kaseya VSA Agent Spawning REvil Deployment and Defender Tampering Commands · unlock with TL Creds
• 🔒 Node or Bun Process Exfiltrating to webhook.site (Shai-Hulud) · unlock with TL Creds
• 🔒 MOVEit Transfer LEMURLOOT [indicator] Web Shell Access (CVE-2023-34362) · unlock with TL Creds
• 🔒 SUNBURST DGA-Style C2 and Secondary Domain DNS Resolution · unlock with TL Creds

Indicators of compromise for Software supply chain attacks

As of 2026-11-07, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5509.

Sample indicators (3 of 27)

• IP address: 178.62.86[.]114
• Domain: avsvmcloud[.]com
• URL: hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How Software supply chain attacks works

The Netlas overview (2025-12-26) summarizes recurring supply-chain compromise patterns: trojanized signed releases, build-pipeline tampering, CI script modification, compromised maintainer credentials, typosquatting, dependency confusion, and exploitation of vendor platforms that fan out to many downstream customers. It is a retrospective article and does not report a new incident, CVE, actor or IOC set. The IOCs and dates below come from the primary sources cited for each incident.

CCleaner (2017): trojanized CCleaner 5.33 (released 2017-08-15) and CCleaner Cloud 1.07.3191 were distributed from official Piriform/Avast infrastructure until 5.34 shipped on 2017-09-12. Cisco Talos found the Floxif-based CCBkdr backdoor, which fetched shellcode from a C2 server. Avast/press estimates are about 2.27 million affected users.

SolarWinds Orion (2020): the SUNBURST backdoor was inserted into the signed solarwinds.orion.core.businesslayer.dll in Orion 2019.4 HF5 through 2020.2 HF1. It used delayed execution, DGA-style subdomains of avsvmcloud.com for C2, and selective activation, with follow-on access to Azure AD/M365 (SAML token abuse). CISA issued Emergency Directive 21-01 on 2020-12-13, and the US Government attributed the campaign to Russia's SVR on 2021-04-15. The article cites 18,000+ organizations.

Codecov (2021): between 2021-01-31 and 2021-04-01 an attacker modified the Bash Uploader using a credential exposed in a Docker image creation error. The altered script sent git remote and environment variables to attacker IPs with curl. Detection came from a customer's SHA-256 comparison of the script, and disclosure followed on 2021-04-15.

Kaseya VSA (2021-07-02): REvil/Sodinokibi pushed ransomware to MSP customers by exploiting VSA zero-days (CVE-2021-30116 and related CVE-2021-30117/30118/30120/30121). The article cites 1,500+ downstream organizations.

MOVEit Transfer (2023): CL0P exploited SQL injection CVE-2023-34362 starting 2023-05-27, deployed the LEMURLOOT web shell (human2.aspx) and bulk-exfiltrated data. CISA added it to KEV on 2023-06-02.

npm Shai-Hulud (2025): a self-replicating worm that runs a post-install bundle.js, uses TruffleHog to harvest GitHub/npm/cloud secrets, and publishes them to attacker-controlled GitHub repositories or webhook endpoints. Shai-Hulud 2.0 (about 2025-11-21 to 11-24) moved to preinstall scripts (setup_bun.js, bun_environment.js). The article cites 33,000+ unique secrets exposed.

The article also covers event-stream/flatmap-stream (2018), left-pad (2016), colors/faker maintainer sabotage, 287 typosquatted npm packages, torchtriton dependency confusion, and defenses (SBOM, Sigstore/SLSA, hash verification, least-privilege short-lived CI credentials).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1568.002 Dynamic Resolution: Domain Generation Algorithms

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Persistence

T1505.003 Server Software Component: Web Shell

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Remediation for Software supply chain attacks

Patches

• Patch MOVEit Transfer for CVE-2023-34362
• Update Kaseya VSA to a version that fixes CVE-2021-30116 (patch released 2021-07-11)

Immediate actions

• Hunt for the IOCs in this record (SUNBURST domains, Codecov uploader IPs, MOVEit human2.aspx, Shai-Hulud bundle.js hashes)
• Rotate GitHub, npm, cloud and CI secrets that were exposed to affected packages or the Codecov Bash Uploader
• Audit GitHub organizations for repositories or branches named shai-hulud and unexpected workflow files

Workarounds

• Restrict MSP and RMM management servers from direct internet exposure
• Block known malicious indicators at the perimeter

Longer-term hardening

• Generate and compare SBOMs (SPDX/CycloneDX) and verify provenance with Sigstore/SLSA
• Verify cryptographic hashes of downloaded CI scripts and dependencies
• Run CI/CD with least privilege and short-lived, frequently rotated credentials
• Pin dependencies and disable lifecycle scripts where feasible

Affected and fixed versions

• SolarWinds — Orion Platform
  Vulnerable versions: 2019.4 HF5 through 2020.2 HF1
• Piriform/Avast — CCleaner / CCleaner Cloud
  Vulnerable versions: CCleaner 5.33; CCleaner Cloud 1.07.3191
  Fixed in: CCleaner 5.34
• Codecov — Bash Uploader
  Vulnerable versions: Versions served 2021-01-31 to 2021-04-01
• Kaseya — VSA
  Vulnerable versions: Before 9.5.7
  Fixed in: 9.5.7
• Progress Software — MOVEit Transfer
  Vulnerable versions: Unpatched instances exploited from 2023-05-27
• npm — npm registry packages (Shai-Hulud)
  Vulnerable versions: Trojanized releases of compromised packages

Timeline of Software supply chain attacks

• 2017-08-15 Trojanized CCleaner 5.33 released via official distribution channels; the locked-ioc-27/CCBkdr backdoor ships in the signed build
• 2017-09-12 CCleaner 5.34 released, ending distribution of the trojanized version; Talos notified Avast on 2017-09-13
• 2020-03-01 locked-ioc-26 campaign begins, with the backdoor inserted into SolarWinds Orion builds (March 2020)
• 2020-12-13 CISA issues Emergency Directive 21-01 for SolarWinds Orion compromise
• 2021-01-31 Codecov Bash Uploader first modified; malicious script intermittently served through 2021-04-01
• 2021-04-15 Codecov publicly discloses the incident; the US Government attributes the SolarWinds campaign to Russia's SVR
• 2021-07-02 REvil/Sodinokibi deploys ransomware to MSP customers by exploiting Kaseya VSA zero-days
• 2021-07-11 Kaseya releases a patch for CVE-2021-30116
• 2023-05-27 CL0P begins exploiting MOVEit Transfer SQL injection CVE-2023-34362
• 2023-06-02 CISA adds CVE-2023-34362 to the Known Exploited Vulnerabilities catalog
• 2023-06-07 CISA and FBI publish advisory AA23-158A on CL0P exploitation of MOVEit
• 2025-11-24 Shai-Hulud 2.0 npm worm identified by the community after compromise activity from about 2025-11-21 to 2025-11-23
• 2025-12-26 Netlas publishes the supply-chain overview summarizing these incidents

Sources cited for Software supply chain attacks

• CISA AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations CISA · Government advisory · 2020-12-17
• CISA AA23-158A: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability CISA · Government advisory · 2023-06-07
• Codecov Security Update (Bash Uploader incident) about.codecov.io · Vendor report · 2021-04-15
• Talos: CCleaner Command and Control Causes Concern / Avast distributes malware Cisco Talos · Research · 2017-09-18
• Tenable: CVE-2021-30116 Multiple Zero-Day Vulnerabilities in Kaseya VSA Exploited to Distribute REvil Ransomware Tenable · Research
• Trend Micro: IT Management Platform Kaseya Hit with Sodinokibi/REvil Ransomware Trend Micro · Research
• Datadog Security Labs: Shai-Hulud 2.0 npm worm securitylabs.datadoghq.com · Research · 2025-11-24
• Check Point: Shai-Hulud 2.0 - Inside The Second Coming Check Point · Research
• Blackpoint Cyber: Inside the Shai-Hulud NPM Supply Chain Attack blackpointcyber.com · Research
• Supply Chain Attack - How Attackers Weaponize Software Supply Chains (Netlas) netlas.io · Blog · 2025-12-26

More in supply chain

• BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)
• Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon
• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware
• Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)

More from REvil

• Kaseya VSA Supply-Chain Ransomware Incident — REvil/Sodinokibi Exploits CVE-2021-30116/30117/30118/30119/30120/30121 to Compromise 60 MSPs and 1,500+ Downstream Organizations
• Armenia Detains Russian National Aleksandr Ermakov on US Extradition Request Tied to Sodinokibi/REvil Ransomware

Other reports on CVE-2023-34362

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages