Shai-Hulud Supply Chain Attack: Detection and Remediation for 600 Compromised npm Packages

---
title: Potential Shai-Hulud NPM Malware - PowerShell Encoded Payload
id: 8d4f2c10-9b5a-4a6e-8d1f-2c3b4a5d6e7f
status: experimental
description: Detects npm or node processes spawning PowerShell with encoded commands, a hallmark of the Shai-Hulud supply chain attack utilizing postinstall scripts.
references:
  - https://www.bleepingcomputer.com/news/security/new-shai-hulud-malware-wave-compromises-600-npm-packages/
author: Security Arsenal
date: 2024/10/24
tags:
  - attack.execution
  - attack.t1059.001
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\npm.exe'
      - '\npm.cmd'
      - '\node.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
  condition: selection
falsepositives:
  - Legitimate build scripts utilizing PowerShell (Rare in standard npm usage)
level: high
---
title: NPM Spawning Shell or Network Tools on Linux
id: 9e5g3d21-0c6b-5b7f-9e2g-3d4c5e6f7a8b
status: experimental
description: Detects npm processes spawning bash, sh, curl, or wget, indicative of malicious postinstall scripts fetching payloads or exfiltrating data.
references:
  - https://www.bleepingcomputer.com/news/security/new-shai-hulud-malware-wave-compromises-600-npm-packages/
author: Security Arsenal
date: 2024/10/24
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/npm'
      - '/node'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate development scripts requiring system calls (Verify script legitimacy)
level: medium

// Hunt for Shai-Hulud indicators: npm spawning suspicious processes
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("npm.exe", "node.exe", "npm", "node")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "curl", "wget")
| extend ProcessCommandLine = ProcessCommandLine // Normalize for display
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, FolderPath
| order by Timestamp desc

-- Hunt for Shai-Hulud: Node.js spawning shells or network tools
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "node"
   OR Parent.Name =~ "npm"
   AND Name =~ "(powershell|pwsh|bash|sh|curl|wget|cmd)"

#!/bin/bash
# Security Arsenal - Shai-Hulud Remediation Scanner
# Scans node_modules for package. files with suspicious script hooks

echo "[*] Shai-Hulud Supply Chain Scanner"
echo "[*] Scanning current directory for node_modules..."

if [ ! -d "node_modules" ]; then
    echo "[!] No node_modules directory found in current path."
    exit 0
fi

echo "[*] Analyzing package. files for suspicious script hooks..."

# Find package. files and check for specific malicious patterns in script sections
find node_modules -name "package." -type f -exec grep -l "\"preinstall\"\|\"postinstall\"\|\"install\"" {} \; | while read -r file; do
    # Extract the script content to check for suspicious keywords
    if grep -A 5 "\"preinstall\"\|\"postinstall\"\|\"install\"" "$file" | grep -iE "curl|wget|bash|sh|powershell|base64|eval|\$\(.*\)" > /dev/null; then
        echo "[!] SUSPICIOUS PACKAGE DETECTED: $file"
        echo "    Contains script hook with shell/network commands."
        # Optional: Output the suspicious line for context
        grep -A 5 "\"preinstall\"\|\"postinstall\"\|\"install\"" "$file" | head -n 6
    fi
done

echo "[*] Scan complete."
echo "[*] Recommended Action: Run 'npm audit' and review specific package versions."