# Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)

> A family of self-propagating supply chain worms (Shai-Hulud, Shai-Hulud 2.0, Mini Shai-Hulud, Miasma, Hades) steals maintainer, CI/CD, cloud and AI-tool credentials and republishes trojanized packages across npm, PyPI, RubyGems and GitHub Actions. TeamPCP open-sourced the Shai-Hulud codebase on GitHub in May 2026 and Miasma source followed on June 9, 2026, raising the likelihood of copycat campaigns.

- **Published:** 2026-11-12T00:35:19Z
- **Last reviewed:** 2026-11-12T00:35:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5808
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5808.png
- **ID:** TL-2026-5808
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

Intel 471 (July 28, 2026) describes supply chain attacks that target packages, maintainer accounts, repositories, CI/CD pipelines and publishing credentials, with credential and secret theft as the primary goal. The first Shai-Hulud event dates to September 2025 and primarily hit npm. Shai-Hulud 2.0 followed in November 2025, and TeamPCP, a group that emerged in November 2025, is described as one of the most active publicly reported groups targeting software supply chains. Mandiant tracks TeamPCP as UNC6780 (per Zscaler ThreatLabz). Related or copycat activity reuses the same propagation logic: Mini Shai-Hulud, Miasma, Hades, IronWorm and GlassWorm.

Shai-Hulud 2.0 packages carry a preinstall hook that runs setup_bun.js, which downloads/installs the Bun runtime and then executes an obfuscated bun_environment.js (~480,000 lines). The payload runs TruffleHog to find secrets, writes exfiltrated data to cloud.json, contents.json, environment.json and truffleSecrets.json, registers a self-hosted GitHub Actions runner and adds a backdoor workflow (.github/workflows/discussion.yaml). Variants were reported with a disk-wipe capability and privileged Docker containers mounting the host filesystem.

In 2026 the code evolved. Zscaler dates the Miasma wave to March 2026, entering through a compromised Trivy scanner (GitHub Actions cache poisoning) and a LiteLLM 1.82.8 release shipping litellm_init.pth, with exfiltration to models.litellm.cloud. The Hades wave on May 11, 2026 abused a pull_request_target misconfiguration in the TanStack monorepo, scraped an OIDC token from Runner.Worker memory and published 84 artifacts across 42 @tanstack packages in six minutes with valid Sigstore provenance. ReversingLabs reports Mini Shai-Hulud compromised more than 150 npm and PyPI packages tied to projects including TanStack, Mistral AI, UiPath, OpenSearch and Guardrails AI. Further waves: @antv republish (May 19), Red Hat (Jun 1-2; 32 packages, 96 versions via a compromised engineer account and orphan commits injecting Actions workflows), an IDE wave (Jun 5; config files that auto-execute on project open, 73 Microsoft repositories disabled) and Hades PyPI (Jun 8; 37 wheels across 19 packages, with prompt injection in _index.js aimed at LLM-based scanners).

Source release: ReversingLabs saw GitHub repositories with the Shai-Hulud source on May 12, 2026; Intel 471 dates TeamPCP's open-source publication to May 13, 2026, accompanied by a forum contest offering roughly $1,000 in Monero for the largest package compromise (BreachForums is reported as sponsoring a supply chain compromise contest). The source reportedly shipped under an MIT license via likely-compromised GitHub accounts, and forks were observed being modified. Miasma source (repository Miasma-Open-Source-Release) was published around June 9, 2026; who released it is unresolved in public reporting, and Zscaler notes attribution after May 12 is less certain. Sources conflict on some dates and naming (e.g. Tenable dates Miasma's open-sourcing to May 12).

SafeDep's analysis of the Miasma toolkit documents propagation through stolen registry tokens and OIDC trusted publishing (npm, PyPI, RubyGems; JFrog Artifactory npm infection untested), GitHub Actions tag hijacking and workflow injection, AWS SSM and SSH lateral movement, and poisoning of AI coding tool configuration (Claude, Gemini, Cursor, Copilot, Kiro, Cline and others). C2 uses GitHub public commit search dead drops with marker strings, exfiltration is via encrypted commits to public repositories under victim accounts, persistence uses systemd user services (Linux) and LaunchAgents (macOS), and a dead-man switch destroys the home directory if the stolen token is revoked. Zscaler also notes ICP blockchain canister C2 in May-June 2026. Only the Intel 471 blog was provided as the initial source; no CVEs apply. BeaconBeagle could not be queried (HTTP 502), so no C2 correlation was recorded.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1199 Trusted Relationship
- T1059.007 JavaScript
- T1059.006 Python
- T1543.002 Systemd Service
- T1543.001 Launch Agent
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1021.004 SSH
- T1102.002 Bidirectional Communication
- T1567.001 Exfiltration to Code Repository
- T1485 Data Destruction
- AML.T0051 LLM Prompt Injection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shai-Hulud: Node Spawning Bun / setup_bun.js Dropper During Package Install** (`TL-2026-5808-SPL-001`)

TL-2026-5808 (Shai-Hulud 2.0 / Mini Shai-Hulud / Miasma / Hades, TeamPCP). Detects the npm preinstall execution chain in which node launches the Bun runtime (setup_bun.js then bun_environment.js) or any process command line references the dropper, payload or truffleSecrets.json exfiltration file. Behaviour-first: fires on node-to-bun parentage even when file hashes change between waves.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1195.001, T1059.007, T1105
- **Data sources:** sysmon, sysmon_for_linux, process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
((index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") OR (index=linux sourcetype="Syslog:Linux-Sysmon/Operational")) EventCode=1 earliest=-24h
| eval parent=lower(ParentImage), child=lower(Image), cmd=lower(CommandLine)
| eval node_parent=if(like(parent,"%node.exe") OR like(parent,"%/node"),1,0)
| eval bun_child=if(like(child,"%bun.exe") OR like(child,"%/bun"),1,0)
| eval ioc_cmd=if(like(cmd,"%setup_bun.js%") OR like(cmd,"%bun_environment.js%") OR like(cmd,"%trufflesecrets.json%"),1,0)
| where (node_parent=1 AND bun_child=1) OR ioc_cmd=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as child_images by host, User, ParentImage
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User ParentImage child_images command_lines count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName in~ ("node", "node.exe") and FileName in~ ("bun", "bun.exe"))
    or ProcessCommandLine has_any ("setup_bun.js", "bun_environment.js", "truffleSecrets.json")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Node Spawning Bun or Shai-Hulud Dropper Artifacts During Package Install
id: 3f6b2a10-8c4d-4e7a-9b21-5d0e6c7f8a11
status: experimental
description: Detects node launching the Bun runtime or command lines referencing setup_bun.js, bun_environment.js or truffleSecrets.json, the Shai-Hulud 2.0 npm preinstall chain (TL-2026-5808).
references:
  - https://www.intel471.com/blog/shai-hulud-worm-20
  - https://cirosec.de/en/news/a-collection-of-shai-hulud-2-0-iocs/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.t1195.001
  - attack.execution
  - attack.t1059.007
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection_node_bun:
    ParentImage|endswith:
      - 'node.exe'
      - '/node'
    Image|endswith:
      - 'bun.exe'
      - '/bun'
  selection_ioc:
    CommandLine|contains:
      - 'setup_bun.js'
      - 'bun_environment.js'
      - 'truffleSecrets.json'
  condition: 1 of selection_*
falsepositives:
  - Legitimate projects that use Bun as their runtime and launch it from node scripts
level: high
```

**Known false positives:**

- Developers or CI jobs that legitimately install and run Bun from node scripts (for example bun-based build tooling)
- Security teams testing Shai-Hulud IOC strings or replaying samples in a lab

**Tuning notes:** Allowlist known build hosts and repositories that officially use Bun by excluding specific host and ParentImage combinations. Keep the setup_bun.js and bun_environment.js string match unfiltered because those names are campaign-specific. Swap index and sourcetype for your EDR process telemetry (for example the CIM Endpoint.Processes data model) if Sysmon is not deployed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Shai-Hulud: Dropper, Payload and Backdoor Workflow File Artifacts and Known Hashes (locked: unlock with TL Creds)
- Shai-Hulud/Miasma: Credential Harvesting, Metadata Probing and Privileged Container Escape from Runtimes (locked: unlock with TL Creds)
- Miasma: Runtime-Spawned SSH and AWS SSM Lateral Movement plus C2 Egress (locked: unlock with TL Creds)
- Poisoned AI Coding Tool or IDE Config Executing [indicator] (locked: unlock with TL Creds)
- Miasma/Hades: Python .pth Persistence and Dead-Man Switch State File Creation (locked: unlock with TL Creds)
- Runtime-Spawned GitHub Self-Hosted Runner Registration, Public Repo Creation and Orphan Commits (locked: unlock with TL Creds)
- Miasma: Runtime-Spawned systemd User Service, Linger and Monitor Persistence (locked: unlock with TL Creds)
- Miasma: GitHub Commit-Search Dead Drop and [indicator] Exfiltration via Web Proxy (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- Domain: `models[.]litellm[.]cloud`
- URL: `hxxps://api[.]anthropic[.]com/v1/api`
- File hash: `a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Software Supply Chain Attacks: Weaponizing Trusted Developer Workflows](https://www.intel471.com/blog/software-supply-chain-attacks-weaponizing-trusted-developer-workflows)
- [Poisoned Trust: How Supply Chain Attacks Weaponize Developer Ecosystems](https://www.intel471.com/resources/whitepapers/poisoned-trust-how-supply-chain-attacks-weaponize-developer-ecosystems)
- [Intel 471: Shai-Hulud Worm 2.0](https://www.intel471.com/blog/shai-hulud-worm-20)
- [Inside the Miasma Software Supply Chain Attack Toolkit (SafeDep)](https://safedep.io/inside-the-miasma-supply-chain-attack-toolkit)
- [Shai-Hulud campaign evolution: Miasma, Hades and AI scanner evasion (Zscaler ThreatLabz)](https://www.zscaler.com/it/blogs/security-research/shai-hulud-campaign-evolution-miasma-hades-and-ai-scanner-evasion)
- [The Shai-Hulud Code Drop (ReversingLabs)](https://reversinglabs.com/blog/the-shai-hulud-code-drop)
- [TeamPCP Ups the Game, Releases Shai-Hulud Worm's Source Code (SecurityWeek)](https://securityweek.com/teampcp-ups-the-game-releases-shai-hulud-worms-source-code)
- [What the Miasma campaign reveals about the new supply chain threat model (Tenable)](https://de.tenable.com/blog/what-the-miasma-campaign-reveals-about-the-new-supply-chain-threat-model-and-the-underground)
- [Miasma worm open-sourced (Dataminr)](https://www.dataminr.com/resources/miasma-worm-open-sourced/)
- [A collection of Shai-Hulud 2.0 IOCs (cirosec)](https://cirosec.de/en/news/a-collection-of-shai-hulud-2-0-iocs/)
- [Shai-Hulud 2.0 ongoing supply chain attack (Wiz)](https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack)
- [GitLab discovers widespread npm supply chain attack](https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/)
- [Defending Against Sha1-Hulud: The Second Coming (SentinelOne)](https://www.sentinelone.com/blog/defending-against-sha1-hulud-the-second-coming/)
- [Shai-Hulud 2.0 MalwareBazaar samples](https://bazaar.abuse.ch/user/27499/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5808