Shai-Hulud ChainDrop npm Worm + AWS Bedrock Token-Jacking: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: npm Lifecycle Script Spawning Credential Access Tools
translation_key: shai_hulud_npm_preinstall_cred_access
id: 7c3f9a21-4b8e-4d2a-9f1c-2e5b8a6d4c71
status: experimental
description: Detects node/npm processes spawned by package lifecycle scripts (preinstall/postinstall) accessing credential stores — consistent with Shai-Hulud/ChainDrop supply chain worm behavior (TensorLake compromise).
author: Security Arsenal Threat Intel
references:
    - https://socket.dev/blog/tensorlake-compromise
date: 2026/10/09
logsource:
    category: process_creation
    product: windows
    os: windows
detection:
    selection_parent:
        ParentCommandLine|contains:
            - 'preinstall'
            - 'postinstall'
            - 'npm install'
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_command:
        CommandLine|contains:
            - '.aws\credentials'
            - '.npmrc'
            - '.kube\config'
            - '.ssh\'
            - '.vault-token'
            - 'GITHUB_TOKEN'
            - 'AWS_ACCESS_KEY_ID'
            - 'id_rsa'
    condition: selection_parent and selection_command
falsepositives:
    - Legitimate build tooling reading config during CI builds
level: high
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1195.002
---
title: Suspicious AWS Credential Validation Burst From Unusual Source
id: 2d8e4b17-9c3a-4f6e-a1d5-8b7c3e9f2a64
status: experimental
description: Detects AWS GetCallerIdentity and Bedrock enumeration calls from non-corporate IP space — consistent with KMON_NOC-style credential validation platforms testing stolen keys for Bedrock access.
author: Security Arsenal Threat Intel
references:
    - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
date: 2026/10/09
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_events:
        eventSource:
            - 'sts.amazonaws.com'
            - 'bedrock.amazonaws.com'
        eventName:
            - 'GetCallerIdentity'
            - 'ListFoundationModels'
            - 'InvokeModel'
            - 'Converse'
    filter_corporate:
        sourceIPAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    filter_known_validation_ips:
        sourceIPAddress:
            - '112.78.151.90'
            - '78.109.78.211'
            - '83.194.172.248'
            - '103.160.185.100'
            - '109.146.93.39'
            - '115.138.247.83'
    condition: selection_events and not filter_corporate
falsepositives:
    - Developers testing from home connections (baseline expected source ASNs per principal)
level: critical
tags:
    - attack.discovery
    - attack.t1526
    - attack.t1078.004
---
title: Exfiltration of SSH Keys or Cloud Credentials to External Webhook
id: 5f1a8c43-2e7d-4b9a-c6e3-1d4f7a8b2e95
status: experimental
description: Detects curl/wget/Invoke-WebRequest transmitting credential files or cloud config content to external endpoints — a common exfil pattern in npm supply chain payloads.
author: Security Arsenal Threat Intel
date: 2026/10/09
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\curl.exe'
            - '\wget.exe'
            - '\powershell.exe'
    selection_exfil:
        CommandLine|contains:
            - 'id_rsa'
            - '.aws'
            - 'credentials'
            - '.npmrc'
            - 'kube/config'
            - '.vault-token'
    selection_net:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '-d @'
            - '-F '
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
    condition: selection_tool and selection_exfil and selection_net
falsepositives:
    - Backup scripts (rarely reference raw credential files)
level: high
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.t1552

// Sentinel hunt: npm/node processes touching credential stores + AWS validation IPs
// MDE: DeviceProcessEvents — Shai-Hulud install-time credential harvesting
let CredPaths = dynamic([".aws/credentials", ".npmrc", ".kube/config", "id_rsa", ".vault-token", "hosts.yml"]);
let ValidationIPs = dynamic(["112.78.151.90", "78.109.78.211", "83.194.172.248", "103.160.185.100", "109.146.93.39", "115.138.247.83"]);
let InstallCredAccess =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("node.exe", "npm.cmd", "npm", "node", "cmd.exe", "powershell.exe", "sh", "bash")
    | where ProcessCommandLine has_any (CredPaths)
       or (InitiatingProcessCommandLine has_any ("preinstall", "postinstall", "npm install", "npm ci"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256;
let ValidationContact =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIP in (ValidationIPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort;
union InstallCredAccess, ValidationContact
| sort by TimeGenerated desc

# IOC Hunt: Shai-Hulud npm worm + AWS credential validation infrastructure
# Run on developer workstations and build agents. Output: findings to console + CSV.
$findings = @()

# 1. Check for compromised TensorLake package version in node_modules trees
Write-Host "[*] Scanning for tensorlake@0.5.144..." -ForegroundColor Cyan
$npmRoots = @("$env:USERPROFILE", "$env:ProgramFiles", "C:\Projects", "C:\dev", "C:\src") | Where-Object { Test-Path $_ }
foreach ($root in $npmRoots) {
    Get-ChildItem -Path $root -Recurse -Filter "package.json" -ErrorAction SilentlyContinue -Depth 6 |
        Where-Object { $_.FullName -match "tensorlake" } |
        ForEach-Object {
            $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
            if ($content -match '"version"\s*:\s*"0\.5\.144"') {
                $findings += [PSCustomObject]@{ Type="MaliciousPackage"; Path=$_.FullName; Detail="tensorlake 0.5.144 confirmed" }
            }
        }
}

# 2. Hash-hunt known malicious payloads in npm cache and node_modules
$malHashes = @(
    "25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef",
    "b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec",
    "923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608",
    "c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc"
)
Write-Host "[*] Hash-hunting npm cache..." -ForegroundColor Cyan
$cacheDir = "$env:LOCALAPPDATA\npm-cache"
if (Test-Path $cacheDir) {
    Get-ChildItem $cacheDir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($malHashes -contains $h.ToLower()) {
            $findings += [PSCustomObject]@{ Type="MaliciousHash"; Path=$_.FullName; Detail=$h }
        }
    }
}

# 3. Flag suspicious preinstall/postinstall hooks across installed packages
Write-Host "[*] Auditing install lifecycle scripts..." -ForegroundColor Cyan
foreach ($root in $npmRoots) {
    Get-ChildItem -Path $root -Recurse -Filter "package.json" -ErrorAction SilentlyContinue -Depth 6 |
        Where-Object { $_.FullName -match "node_modules" } |
        ForEach-Object {
            $c = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
            if ($c -match '"(preinstall|postinstall)"\s*:\s*"[^"]*(curl|wget|Invoke-|base64|eval|child_process|\.ssh|\.aws)') {
                $findings += [PSCustomObject]@{ Type="SuspiciousHook"; Path=$_.FullName; Detail="Lifecycle script with credential/exfil indicators" }
            }
        }
}

# 4. Check active/historical network connections to validation infrastructure
$badIPs = @("112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83")
Write-Host "[*] Checking connections to validation IPs..." -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress } |
    ForEach-Object { $findings += [PSCustomObject]@{ Type="MaliciousConnection"; Path="PID $($_.OwningProcess)"; Detail=$_.RemoteAddress } }

# 5. Evidence of credential store access staging (recently modified credential files)
$credFiles = @("$env:USERPROFILE\.aws\credentials", "$env:USERPROFILE\.npmrc", "$env:USERPROFILE\.kube\config", "$env:USERPROFILE\.vault-token")
foreach ($f in $credFiles) {
    if (Test-Path $f) {
        $item = Get-Item $f
        if ($item.LastWriteTime -gt (Get-Date).AddDays(-7)) {
            $findings += [PSCustomObject]@{ Type="CredentialFileRecentChange"; Path=$f; Detail="Modified $($item.LastWriteTime)" }
        }
    }
}

$findings | Format-Table -AutoSize
$findings | Export-Csv -Path ".\shaihulud_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[*] Hunt complete. $($findings.Count) findings." -ForegroundColor Green