Equation of Compromise: npm Supply-Chain Loader with Ethereum Smart Contract C2 — OTX Pulse Detection Pack

---
title: Node.js Process Querying Ethereum Sepolia RPC Endpoint
id: 8f3a1c2e-7b4d-4e6f-9a1b-2c5d8e9f0a11
status: experimental
description: Detects node.exe/node processes initiating network connections to Ethereum Sepolia testnet RPC endpoints, consistent with smart-contract-based C2 dead-drop resolution used by the Equation of Compromise npm supply-chain campaign.
author: Security Arsenal Threat Intelligence
references:
  - https://research.jfrog.com/post/equation-of-compromise/
  - https://otx.alienvault.com/pulse/
date: 2026/09/23
logsource:
  category: network_connection
  product: windows
  definition: Requires Sysmon Event ID 3 or equivalent network connection logging
detection:
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\node'
  selection_destination:
    DestinationHostname|contains:
      - 'sepolia.org'
      - 'sepolia.infura.io'
      - 'eth-sepolia'
      - 'sepolia.g.alchemy.com'
  condition: selection_process and selection_destination
falsepositives:
  - Legitimate DeFi/Web3 developers testing contracts against Sepolia testnet
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
---
title: Suspicious Child Process Spawned by Node During Build or Package Execution
id: 9b4c2d3f-8c5e-4f7a-ab2c-3d6e9f1a2b22
status: experimental
description: Detects node.exe spawning shell, script, or credential-access child processes — a common post-decryption execution pattern for npm supply-chain loaders abusing postinstall hooks and GitHub Actions runners.
author: Security Arsenal Threat Intelligence
references:
  - https://research.jfrog.com/post/equation-of-compromise/
date: 2026/09/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate npm lifecycle scripts (postinstall) in trusted build pipelines
  - Developer tooling and package build steps
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195.002
---
title: Malicious npm Loader File Hash Match — Equation of Compromise Campaign
id: ac5d3e4a-9d6f-4a8b-bc3d-4e7f0a2b3c33
status: experimental
description: Detects file creation or execution events matching MD5 hashes of malicious npm package artifacts from the Equation of Compromise supply-chain campaign targeting DeFi and quantitative developers.
author: Security Arsenal Threat Intelligence
references:
  - https://research.jfrog.com/post/equation-of-compromise/
date: 2026/09/23
logsource:
  category: file_event
  product: windows
detection:
  selection_hashes:
    MD5:
      - '91e020c13cb97a6365135b53b0d0fe5f'
      - 'd3d6e819028346a0b973bd5dd371c468'
      - 'dc7257d09fab42eca2c354c32fec1938'
  condition: selection_hashes
falsepositives:
  - None expected; these hashes are confirmed malicious campaign artifacts
level: critical
tags:
  - attack.t1195.002
  - attack.initial_access

// Hunt: npm supply-chain campaign — blockchain C2, loader hashes, and node-spawned children
let BadHashes = dynamic(["91e020c13cb97a6365135b53b0d0fe5f", "d3d6e819028346a0b973bd5dd371c468", "dc7257d09fab42eca2c354c32fec1938"]);
let FileHits = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where MD5 in~ (BadHashes)
| project TimeGenerated, DeviceName, FolderPath, FileName, MD5, InitiatingProcessCommandLine;
let BlockchainC2 = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "node.exe"
| where RemoteUrl has_any ("sepolia", "infura.io", "alchemy.com", "quicknode")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine;
let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "npm.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "certutil.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine;
union FileHits, BlockchainC2, SuspiciousChildren
| sort by TimeGenerated desc

# Equation of Compromise — npm supply-chain IOC hunt script
# Checks npm caches, node_modules, running Node processes, and blockchain RPC connections
$badHashes = @("91e020c13cb97a6365135b53b0d0fe5f","d3d6e819028346a0b973bd5dd371c468","dc7257d09fab42eca2c354c32fec1938")

Write-Host "=== [1/4] Hash sweep: npm cache and node_modules ===" -ForegroundColor Cyan
$searchRoots = @("$env:APPDATA\npm-cache", "$env:LOCALAPPDATA\npm-cache", "$env:USERPROFILE\.npm\_cacache", "C:\dev", "C:\projects", "C:\actions-runner")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -lt 50MB } |
            ForEach-Object {
                $h = (Get-FileHash -Algorithm MD5 -Path $_.FullName -ErrorAction SilentlyContinue).Hash
                if ($badHashes -contains $h.ToLower()) {
                    Write-Host "[HIT] $($_.FullName)  MD5=$h" -ForegroundColor Red
                }
            }
    }
}

Write-Host "=== [2/4] Running Node.js processes and command lines ===" -ForegroundColor Cyan
Get-CimInstance Win32_Process -Filter "Name='node.exe'" |
    Select-Object ProcessId, CommandLine, ExecutablePath | Format-List

Write-Host "=== [3/4] Active connections to blockchain RPC endpoints ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.OwningProcess -in (Get-Process node -ErrorAction SilentlyContinue).Id } |
    ForEach-Object {
        $resolved = (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
        if ($resolved -match "sepolia|infura|alchemy|quicknode") {
            Write-Host "[C2 SUSPECT] PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort) ($resolved)" -ForegroundColor Red
        }
    }

Write-Host "=== [4/4] GitHub Actions runner artifacts ===" -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match "actions|runner" } | Format-List TaskName, State
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "actions.runner" } | Format-List Name, Status, StartType
Write-Host "Hunt complete. Escalate any [HIT] or [C2 SUSPECT] findings to IR immediately." -ForegroundColor Green