Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5808 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shai-Hulud: Node Spawning Bun / setup_bun.js Dropper During Package Install

TL-2026-5808 (Shai-Hulud 2.0 / Mini Shai-Hulud / Miasma / Hades, TeamPCP). Detects the npm preinstall execution chain in which node launches the Bun runtime (setup_bun.js then bun_environment.js) or any process command line references the dropper, payload or truffleSecrets.json exfiltration file. Behaviour-first: fires on node-to-bun parentage even when file hashes change between waves.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1195.001, T1059.007, T1105
• Data sources: sysmon, sysmon_for_linux, process_creation
• Severity: critical
• Confidence: high

Splunk SPL

((index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") OR (index=linux sourcetype="Syslog:Linux-Sysmon/Operational")) EventCode=1 earliest=-24h
| eval parent=lower(ParentImage), child=lower(Image), cmd=lower(CommandLine)
| eval node_parent=if(like(parent,"%node.exe") OR like(parent,"%/node"),1,0)
| eval bun_child=if(like(child,"%bun.exe") OR like(child,"%/bun"),1,0)
| eval ioc_cmd=if(like(cmd,"%setup_bun.js%") OR like(cmd,"%bun_environment.js%") OR like(cmd,"%trufflesecrets.json%"),1,0)
| where (node_parent=1 AND bun_child=1) OR ioc_cmd=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as child_images by host, User, ParentImage
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User ParentImage child_images command_lines count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName in~ ("node", "node.exe") and FileName in~ ("bun", "bun.exe"))
    or ProcessCommandLine has_any ("setup_bun.js", "bun_environment.js", "truffleSecrets.json")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Node Spawning Bun or Shai-Hulud Dropper Artifacts During Package Install
id: 3f6b2a10-8c4d-4e7a-9b21-5d0e6c7f8a11
status: experimental
description: Detects node launching the Bun runtime or command lines referencing setup_bun.js, bun_environment.js or truffleSecrets.json, the Shai-Hulud 2.0 npm preinstall chain (TL-2026-5808).
references:
  - https://www.intel471.com/blog/shai-hulud-worm-20
  - https://cirosec.de/en/news/a-collection-of-shai-hulud-2-0-iocs/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.t1195.001
  - attack.execution
  - attack.t1059.007
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection_node_bun:
    ParentImage|endswith:
      - 'node.exe'
      - '/node'
    Image|endswith:
      - 'bun.exe'
      - '/bun'
  selection_ioc:
    CommandLine|contains:
      - 'setup_bun.js'
      - 'bun_environment.js'
      - 'truffleSecrets.json'
  condition: 1 of selection_*
falsepositives:
  - Legitimate projects that use Bun as their runtime and launch it from node scripts
level: high

Known false positives:

• Developers or CI jobs that legitimately install and run Bun from node scripts (for example bun-based build tooling)
• Security teams testing Shai-Hulud IOC strings or replaying samples in a lab

Tuning notes: Allowlist known build hosts and repositories that officially use Bun by excluding specific host and ParentImage combinations. Keep the setup_bun.js and bun_environment.js string match unfiltered because those names are campaign-specific. Swap index and sourcetype for your EDR process telemetry (for example the CIM Endpoint.Processes data model) if Sysmon is not deployed.

• 🔒 Shai-Hulud: Dropper, Payload and Backdoor Workflow File Artifacts and Known Hashes · unlock with TL Creds
• 🔒 Shai-Hulud/Miasma: Credential Harvesting, Metadata Probing and Privileged Container Escape from Runtimes · unlock with TL Creds
• 🔒 Miasma: Runtime-Spawned SSH and AWS SSM Lateral Movement plus C2 Egress · unlock with TL Creds
• 🔒 Poisoned AI Coding Tool or IDE Config Executing [indicator] · unlock with TL Creds
• 🔒 Miasma/Hades: Python .pth Persistence and Dead-Man Switch State File Creation · unlock with TL Creds
• 🔒 Runtime-Spawned GitHub Self-Hosted Runner Registration, Public Repo Creation and Orphan Commits · unlock with TL Creds
• 🔒 Miasma: Runtime-Spawned systemd User Service, Linger and Monitor Persistence · unlock with TL Creds
• 🔒 Miasma: GitHub Commit-Search Dead Drop and [indicator] Exfiltration via Web Proxy · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5808.

Sample indicators (3 of 25)

• Domain: models[.]litellm[.]cloud
• URL: hxxps://api[.]anthropic[.]com/v1/api
• File hash: a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

Technical analysis

Intel 471 (July 28, 2026) describes supply chain attacks that target packages, maintainer accounts, repositories, CI/CD pipelines and publishing credentials, with credential and secret theft as the primary goal. The first Shai-Hulud event dates to September 2025 and primarily hit npm. Shai-Hulud 2.0 followed in November 2025, and TeamPCP, a group that emerged in November 2025, is described as one of the most active publicly reported groups targeting software supply chains. Mandiant tracks TeamPCP as UNC6780 (per Zscaler ThreatLabz). Related or copycat activity reuses the same propagation logic: Mini Shai-Hulud, Miasma, Hades, IronWorm and GlassWorm.

Shai-Hulud 2.0 packages carry a preinstall hook that runs setup_bun.js, which downloads/installs the Bun runtime and then executes an obfuscated bun_environment.js (~480,000 lines). The payload runs TruffleHog to find secrets, writes exfiltrated data to cloud.json, contents.json, environment.json and truffleSecrets.json, registers a self-hosted GitHub Actions runner and adds a backdoor workflow (.github/workflows/discussion.yaml). Variants were reported with a disk-wipe capability and privileged Docker containers mounting the host filesystem.

In 2026 the code evolved. Zscaler dates the Miasma wave to March 2026, entering through a compromised Trivy scanner (GitHub Actions cache poisoning) and a LiteLLM 1.82.8 release shipping litellm_init.pth, with exfiltration to models.litellm.cloud. The Hades wave on May 11, 2026 abused a pull_request_target misconfiguration in the TanStack monorepo, scraped an OIDC token from Runner.Worker memory and published 84 artifacts across 42 @tanstack packages in six minutes with valid Sigstore provenance. ReversingLabs reports Mini Shai-Hulud compromised more than 150 npm and PyPI packages tied to projects including TanStack, Mistral AI, UiPath, OpenSearch and Guardrails AI. Further waves: @antv republish (May 19), Red Hat (Jun 1-2; 32 packages, 96 versions via a compromised engineer account and orphan commits injecting Actions workflows), an IDE wave (Jun 5; config files that auto-execute on project open, 73 Microsoft repositories disabled) and Hades PyPI (Jun 8; 37 wheels across 19 packages, with prompt injection in _index.js aimed at LLM-based scanners).

Source release: ReversingLabs saw GitHub repositories with the Shai-Hulud source on May 12, 2026; Intel 471 dates TeamPCP's open-source publication to May 13, 2026, accompanied by a forum contest offering roughly $1,000 in Monero for the largest package compromise (BreachForums is reported as sponsoring a supply chain compromise contest). The source reportedly shipped under an MIT license via likely-compromised GitHub accounts, and forks were observed being modified. Miasma source (repository Miasma-Open-Source-Release) was published around June 9, 2026; who released it is unresolved in public reporting, and Zscaler notes attribution after May 12 is less certain. Sources conflict on some dates and naming (e.g. Tenable dates Miasma's open-sourcing to May 12).

SafeDep's analysis of the Miasma toolkit documents propagation through stolen registry tokens and OIDC trusted publishing (npm, PyPI, RubyGems; JFrog Artifactory npm infection untested), GitHub Actions tag hijacking and workflow injection, AWS SSM and SSH lateral movement, and poisoning of AI coding tool configuration (Claude, Gemini, Cursor, Copilot, Kiro, Cline and others). C2 uses GitHub public commit search dead drops with marker strings, exfiltration is via encrypted commits to public repositories under victim accounts, persistence uses systemd user services (Linux) and LaunchAgents (macOS), and a dead-man switch destroys the home directory if the stolen token is revoked. Zscaler also notes ICP blockchain canister C2 in May-June 2026. Only the Intel 471 blog was provided as the initial source; no CVEs apply. BeaconBeagle could not be queried (HTTP 502), so no C2 correlation was recorded.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; T1059.006 Python; T1059.007 JavaScript

Lateral Movement

T1021.004 SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion

Command and Control

T1102.002 Bidirectional Communication

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Impact

T1485 Data Destruction

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555 Credentials from Password Stores

Persistence

T1543.001 Launch Agent; T1543.002 Systemd Service

Exfiltration

T1567.001 Exfiltration to Code Repository

Privilege Escalation

T1611 Escape to Host

Remediation

Patches

• No CVE or vendor patch applies; remove and replace compromised package versions with known-good releases from maintainer advisories

Immediate actions

• Hunt for setup_bun.js, bun_environment.js, .github/workflows/discussion.yaml and shai-hulud-workflow.yml in repositories and node_modules
• Hunt for node spawning bun during npm preinstall/postinstall, TruffleHog execution on developer/CI hosts, and node invoking systemctl
• Rotate npm, PyPI, RubyGems, GitHub, cloud and CI/CD secrets on any host or runner that installed an affected package; revoke tokens before removing persistence because some variants wipe data when the token is revoked
• Review GitHub accounts for unexpected public repositories with Dune-themed names, orphan commits, force-pushed v* tags and new self-hosted runners
• Check Python site-packages for unexpected .pth files such as litellm_init.pth and -setup.pth

Workarounds

• Run npm install with --ignore-scripts in untrusted contexts
• Block cloud instance metadata service access from build jobs that do not need it
• Block outbound access to models.litellm.cloud

Longer-term hardening

• Add behavioral detection (anomalous egress, anomalous access to credential files) rather than relying on hash matching
• Restrict pull_request_target workflows and lock down OIDC trusted publishing and environment protection rules
• Pin dependencies, delay adoption of newly published versions and disable lifecycle scripts in CI where feasible
• Review AI coding tool configuration files (.claude/settings.json, .cursor/rules, .vscode/tasks.json, .gemini/settings.json) in code review
• Reduce maintainer account takeover risk with phishing-resistant MFA and short-lived tokens
• Treat an LLM scanner returning no verdict or a refusal as a signal to escalate

Affected and fixed versions

• npm — npm registry packages (maintainer accounts and publishing tokens)
  Vulnerable versions: Trojanized package versions published during the campaigns
• Python Software Foundation — PyPI packages
  Vulnerable versions: litellm 1.82.8; Hades PyPI wheels (37 wheels across 19 packages)
• RubyGems — RubyGems packages
• JFrog — Artifactory
• GitHub — GitHub Actions and repositories

Timeline

• 2025-09-14 First Shai-Hulud event primarily targeting npm packages (start of Intel 471 timeline).
• 2025-11-01 TeamPCP emerges (November 2025; exact day not stated); Shai-Hulud 2.0 follow-on worm campaign reuses npm lifecycle-hook propagation with Bun-based payload.
• 2026-03-23 locked-ioc-14 registered; Miasma wave (March 2026) enters via compromised Trivy scanner and LiteLLM 1.82.8 shipping locked-ioc-17 (Zscaler).
• 2026-05-11 Mini Shai-Hulud/Hades wave abuses pull_request_target in TanStack monorepo; 84 artifacts across 42 @tanstack packages published within six minutes with valid Sigstore provenance.
• 2026-05-12 ReversingLabs observes GitHub repositories containing the Shai-Hulud worm source code; GitHub later removes originals but forks appear.
• 2026-05-13 Per Intel 471, TeamPCP publishes Shai-Hulud as open source on GitHub with a forum contest offering roughly $1,000 in Monero for the largest package compromise.
• 2026-05-19 About 314 @antv package versions published within a six-second window (per Snyk via Zscaler).
• 2026-06-01 Red Hat wave (Jun 1-2): compromised engineer GitHub account injects Actions workflows via orphan commits; 32 packages and 96 versions published.
• 2026-06-05 IDE wave: compromised contributor account pushes config files that auto-execute on project open; 73 Microsoft repositories disabled across four organizations.
• 2026-06-08 Hades PyPI wave: 37 wheels across 19 packages with prompt injection in locked-ioc-21 aimed at LLM-based scanners.
• 2026-06-09 Miasma source code published on GitHub (Miasma-Open-Source-Release), extending the codebase to npm, PyPI, RubyGems and JFrog Artifactory.
• 2026-07-28 Intel 471 publishes analysis of supply chain attacks weaponizing trusted developer workflows.

Sources cited

• Poisoned Trust: How Supply Chain Attacks Weaponize Developer Ecosystems intel471.com · Research · 2026-07-28
• Inside the Miasma Software Supply Chain Attack Toolkit (SafeDep) safedep.io · Research · 2026-06-09
• Shai-Hulud campaign evolution: Miasma, Hades and AI scanner evasion (Zscaler ThreatLabz) zscaler.com · Vendor report
• The Shai-Hulud Code Drop (ReversingLabs) reversinglabs.com · Research · 2026-05-14
• What the Miasma campaign reveals about the new supply chain threat model (Tenable) Tenable · Vendor report
• Miasma worm open-sourced (Dataminr) dataminr.com · Vendor report · 2026-06-09
• A collection of Shai-Hulud 2.0 IOCs (cirosec) cirosec.de · Research
• Shai-Hulud 2.0 ongoing supply chain attack (Wiz) Wiz · Vendor report
• GitLab discovers widespread npm supply chain attack GitLab · Vendor report
• Defending Against Sha1-Hulud: The Second Coming (SentinelOne) SentinelOne · Vendor report
• Shai-Hulud 2.0 MalwareBazaar samples bazaar.abuse.ch · Research
• Software Supply Chain Attacks: Weaponizing Trusted Developer Workflows intel471.com · Blog · 2026-07-28
• Intel 471: Shai-Hulud Worm 2.0 intel471.com · Blog
• TeamPCP Ups the Game, Releases Shai-Hulud Worm's Source Code (SecurityWeek) SecurityWeek · News

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials
• AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)

More from TeamPCP

• Developer credential exposure on dev machines: StepSecurity Dev Machine Guard credential-source inventory (context: TeamPCP stealer, Bitwarden CLI npm hijack, Shai-Hulud)
• Open Source Supply Chain Attack Surge: 56 Confirmed Attacks in 12 Months Across npm, PyPI, RubyGems, Composer, Rust Crates and GitHub Actions (Shai-Hulud, TeamPCP, Axios, Miasma, ChainDrop)
• Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)
• Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload
• Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
• Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages