Skip to content

Commit 83baaa1

Browse files
NikoCosmico01NikoCosmico01
committed
new: Node.js package manager supply-chain execution hunts (win/lnx/macos)
1 parent 282369f commit 83baaa1

3 files changed

Lines changed: 196 additions & 0 deletions

File tree

‎rules-threat-hunting/linux/process_creation/proc_creation_lnx_nodejs_pkg_manager_susp_child.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
title: Node.js Package Manager Spawning Download Or Reverse Shell - Linux
2+
id: 555bb260-53f8-45b5-a693-76b9c77a712a
3+
status: experimental
4+
description: |
5+
Detects a Node.js runtime or JavaScript package manager (node / bun, the executors behind npm, pnpm and yarn) spawning a shell that downloads-and-executes payloads or opens a reverse shell, or invoking a scripting interpreter with a network download cradle.
6+
This behaviour is characteristic of install-time "lifecycle hook" (preinstall/postinstall) abuse used in modern npm supply-chain compromises (e.g. Shai-Hulud, the @tanstack "Mini Shai-Hulud" and the axios "plain-crypto-js" campaigns), which increasingly target Linux developer workstations and CI runners.
7+
Unlike campaign-specific indicator rules, this is a generic behavioural hunt intended to surface the next compromise before its IOCs are published.
8+
references:
9+
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
10+
- https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package
11+
- https://docs.npmjs.com/cli/v10/using-npm/scripts
12+
author: Nicolò Thei, NikoCosmico01
13+
date: 2026-07-12
14+
tags:
15+
- attack.execution
16+
- attack.t1059.004
17+
- attack.t1059.006
18+
- attack.t1059.007
19+
- attack.t1195.002
20+
- detection.threat-hunting
21+
logsource:
22+
category: process_creation
23+
product: linux
24+
detection:
25+
selection_shell:
26+
ParentImage|endswith:
27+
- '/node'
28+
- '/bun'
29+
Image|endswith:
30+
- '/bash'
31+
- '/dash'
32+
- '/ksh'
33+
- '/sh'
34+
- '/zsh'
35+
CommandLine|contains:
36+
- 'base64 -d'
37+
- 'base64 --decode'
38+
- 'chmod +x'
39+
- 'curl '
40+
- '/dev/tcp/'
41+
- 'nohup '
42+
- '| bash'
43+
- '|bash'
44+
- '| sh'
45+
- '|sh'
46+
- 'wget '
47+
selection_interpreter:
48+
ParentImage|endswith:
49+
- '/node'
50+
- '/bun'
51+
Image|endswith:
52+
- '/perl'
53+
- '/php'
54+
- '/python'
55+
- '/python3'
56+
- '/ruby'
57+
CommandLine|contains:
58+
- 'b64decode'
59+
- 'base64'
60+
- '/dev/tcp/'
61+
- 'socket'
62+
- 'urllib'
63+
condition: 1 of selection_*
64+
falsepositives:
65+
- Legitimate "preinstall"/"postinstall" scripts that fetch prebuilt native binaries via curl/wget. Baseline per project and allowlist known-good packages.
66+
- Build tooling that invokes Python/Perl/Ruby for setup tasks.
67+
level: medium

‎rules-threat-hunting/macos/process_creation/proc_creation_macos_nodejs_pkg_manager_susp_child.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
title: Node.js Package Manager Spawning Download Or Reverse Shell - macOS
2+
id: c210982b-6001-4f1f-96ad-70fef301e066
3+
status: experimental
4+
description: |
5+
Detects a Node.js runtime or JavaScript package manager (node / bun, the executors behind npm, pnpm and yarn) spawning a shell that downloads-and-executes payloads or opens a reverse shell, or invoking a scripting interpreter with a network download cradle.
6+
This behaviour is characteristic of install-time "lifecycle hook" (preinstall/postinstall) abuse used in modern npm supply-chain compromises (e.g. Shai-Hulud, the @tanstack "Mini Shai-Hulud" and the axios "plain-crypto-js" campaigns), which also target macOS developer workstations.
7+
Unlike campaign-specific indicator rules, this is a generic behavioural hunt intended to surface the next compromise before its IOCs are published.
8+
references:
9+
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
10+
- https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package
11+
- https://docs.npmjs.com/cli/v10/using-npm/scripts
12+
author: Nicolò Thei, NikoCosmico01
13+
date: 2026-07-12
14+
tags:
15+
- attack.execution
16+
- attack.t1059.004
17+
- attack.t1059.006
18+
- attack.t1059.007
19+
- attack.t1195.002
20+
- detection.threat-hunting
21+
logsource:
22+
category: process_creation
23+
product: macos
24+
detection:
25+
selection_shell:
26+
ParentImage|endswith:
27+
- '/node'
28+
- '/bun'
29+
Image|endswith:
30+
- '/bash'
31+
- '/dash'
32+
- '/ksh'
33+
- '/sh'
34+
- '/zsh'
35+
CommandLine|contains:
36+
- 'base64 -D'
37+
- 'base64 -d'
38+
- 'chmod +x'
39+
- 'curl '
40+
- '/dev/tcp/'
41+
- 'nohup '
42+
- '| bash'
43+
- '|bash'
44+
- '| sh'
45+
- '|sh'
46+
- 'osascript'
47+
- 'wget '
48+
selection_interpreter:
49+
ParentImage|endswith:
50+
- '/node'
51+
- '/bun'
52+
Image|endswith:
53+
- '/perl'
54+
- '/php'
55+
- '/python'
56+
- '/python3'
57+
- '/ruby'
58+
CommandLine|contains:
59+
- 'b64decode'
60+
- 'base64'
61+
- '/dev/tcp/'
62+
- 'socket'
63+
- 'urllib'
64+
condition: 1 of selection_*
65+
falsepositives:
66+
- Legitimate "preinstall"/"postinstall" scripts that fetch prebuilt native binaries via curl/wget. Baseline per project and allowlist known-good packages.
67+
- Build tooling that invokes Python/Perl/Ruby for setup tasks.
68+
level: medium

‎rules-threat-hunting/windows/process_creation/proc_creation_win_nodejs_pkg_manager_lolbin_execution.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
title: LOLBIN Or Encoded PowerShell Spawned By Node.js Package Manager
2+
id: 166bdb44-b051-46ef-8fe2-d9c9d18361c8
3+
status: experimental
4+
description: |
5+
Detects a Node.js runtime or JavaScript package manager (node.exe / bun.exe, the executors behind npm, pnpm and yarn) spawning a download/execution LOLBIN or an obfuscated PowerShell command, either directly or through a "cmd /c" lifecycle-script shell.
6+
This behaviour is characteristic of install-time "lifecycle hook" (preinstall/postinstall) abuse used in modern npm supply-chain compromises (e.g. Shai-Hulud, the @tanstack "Mini Shai-Hulud" and the axios "plain-crypto-js" campaigns), where a trojanised dependency executes attacker code the moment it is installed on a developer or CI host.
7+
Unlike campaign-specific indicator rules, this is a generic behavioural hunt intended to surface the next compromise before its IOCs are published.
8+
references:
9+
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
10+
- https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package
11+
- https://docs.npmjs.com/cli/v10/using-npm/scripts
12+
author: Nicolò Thei, NikoCosmico01
13+
date: 2026-07-12
14+
tags:
15+
- attack.execution
16+
- attack.t1059.001
17+
- attack.t1059.007
18+
- attack.t1195.002
19+
- detection.threat-hunting
20+
logsource:
21+
category: process_creation
22+
product: windows
23+
detection:
24+
selection_lolbin_direct:
25+
ParentImage|endswith:
26+
- '\node.exe'
27+
- '\bun.exe'
28+
Image|endswith:
29+
- '\bitsadmin.exe'
30+
- '\certutil.exe'
31+
- '\cscript.exe'
32+
- '\mshta.exe'
33+
- '\regsvr32.exe'
34+
- '\wscript.exe'
35+
selection_shell_payload:
36+
ParentImage|endswith:
37+
- '\node.exe'
38+
- '\bun.exe'
39+
Image|endswith:
40+
- '\cmd.exe'
41+
- '\powershell.exe'
42+
- '\pwsh.exe'
43+
CommandLine|contains:
44+
- 'bitsadmin'
45+
- 'certutil'
46+
- 'DownloadFile'
47+
- 'DownloadString'
48+
- 'FromBase64String'
49+
- 'Invoke-WebRequest'
50+
- 'iwr '
51+
- 'mshta'
52+
- 'regsvr32'
53+
- 'Start-BitsTransfer'
54+
- ' -enc'
55+
- ' -windowstyle hidden'
56+
- ' -w hidden'
57+
condition: 1 of selection_*
58+
falsepositives:
59+
- Legitimate package "preinstall"/"postinstall" scripts that fetch prebuilt native binaries or invoke the Windows Script Host (some node-gyp / prebuild-install flows). Baseline per project and allowlist known-good packages.
60+
- Developer or CI setup tooling that intentionally shells out to PowerShell for provisioning tasks.
61+
level: medium

0 commit comments

Comments
 (0)