npm Supply Chain Attacks: Detecting Shai Hulud-style Malware and CI/CD Persistence

---
title: Potential Malicious NPM Package Execution via Shell Spawning
id: 8a4f2c1d-5e6b-4a3c-9d1e-0f2a3b4c5d6e
status: experimental
description: Detects Node.js processes spawning suspicious shells (cmd, powershell, bash), a common TTP in malicious npm packages like Shai Hulud to execute post-exploitation payloads.
references:
  - https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit:
    # Filter out common developer build tools that might spawn shells legitimately
    CommandLine|contains:
      - 'webpack'
      - 'gulp'
      - 'grunt'
      - 'vite'
  condition: selection_parent and selection_child and not filter_legit
falsepositives:
  - Legitimate build scripts utilizing shell commands for automation
level: high
---
title: NPM Process Modifying Git Configuration
id: 9b5e3d2f-6f7c-5b4d-0e2f-1a3b4c5d6e7f
status: experimental
description: Detects npm or node processes attempting to modify .git/config or creating hooks, indicative of persistence mechanisms or supply chain tampering.
references:
  - https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.persistence
  - attack.t1136
logsource:
  category: file_change
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
    TargetFilename|contains:
      - '\.git\config'
      - '\.git\hooks\'
  condition: selection
falsepositives:
  - Legitimate setup scripts configuring git for the first time
level: medium
---
title: Suspicious NPM Install with Network Connection
id: 1c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects npm install events followed closely by a network connection from the node process to a non-standard public IP, suggesting C2 beacons or data exfiltration.
references:
  - https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    Initiated: 'true'
    DestinationPort|notin:
      - '80'
      - '443'
      - '8080'
  filter:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection and not filter
falsepositives:
  - Local development servers connecting to backend DBs or APIs
level: medium

// Hunt for NPM processes spawning shells or making suspicious network connections
let SuspiciousParents = dynamic(["node.exe", "npm.cmd"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ SuspiciousParents
| where FileName in~ SuspiciousChildren
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath
| distinct *
// Join with network events to see if Node connected to external IPs shortly after
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName in~ SuspiciousParents
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "127."
    | project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
) on DeviceName, Timestamp

-- Hunt for package. files with suspicious scripts (postinstall, preinstall)
-- and identify node processes connecting to the network
LET package_files = SELECT FullPath, Mtime
FROM glob(globs="/*/package.")
WHERE read_file(filename=FullPath)
   =~ "(?i)(preinstall|postinstall|prepublish)" AND
   read_file(filename=FullPath) =~ "(?i)(curl|wget|base64|eval|child_process)"

SELECT package_files.FullPath, package_files.Mtime,
       Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Name = "node" AND CommandLine =~ "(http|https)"

# PowerShell Script to Audit NPM Environment for Malicious Packages
# Usage: Run as Administrator in the root of your project or CI agent workspace

Write-Host "[*] Starting NPM Security Audit..." -ForegroundColor Cyan

# 1. Check for globally installed packages that might be malicious
Write-Host "[+] Auditing Global NPM Packages..." -ForegroundColor Yellow
$globalPackages = npm list -g --depth=0 2>&1
Write-Host $globalPackages

# 2. Check for packages with known suspicious scripts (heuristic)
Write-Host "[+] Scanning package. for suspicious scripts..." -ForegroundColor Yellow
if (Test-Path "package.") {
    $content = Get-Content "package." -Raw
    $suspiciousStrings = @("curl", "wget", "base64", "child_process", "eval(", "powershell", "cmd.exe")
    
    foreach ($str in $suspiciousStrings) {
        if ($content -match $str) {
            Write-Host "[!] WARNING: Found '$str' in package.. Please review manually." -ForegroundColor Red
        }
    }
} else {
    Write-Host "[!] No package. found in current directory." -ForegroundColor Yellow
}

# 3. Run NPM Audit
Write-Host "[+] Running 'npm audit' for known vulnerabilities..." -ForegroundColor Yellow
npm audit --audit-level=moderate

# 4. Check Environment Variables for exposed secrets (heuristic)
Write-Host "[+] Checking Process Environment for leaked secrets..." -ForegroundColor Yellow
$envVars = Get-ChildItem Env:
$keywords = @("API_KEY", "TOKEN", "SECRET", "PASSWORD", "AWS_")
foreach ($var in $envVars) {
    foreach ($key in $keywords) {
        if ($var.Name -like "*$key*") {
            Write-Host ("[!] Potential Secret found in env: " + $var.Name) -ForegroundColor Red
        }
    }
}

Write-Host "[*] Audit Complete." -ForegroundColor Green