Supply Chain Attacks: Detecting `node-ipc`, `@antv`, and Malicious GitHub Actions

---
title: Suspicious Node.js Child Process Execution - Potential Supply Chain
id: 8a4f1c23-9b5e-4d12-a8c5-1d2e3f4b5c6a
status: experimental
description: Detects Node.js spawning shell processes, a common behavior in malicious npm packages like node-ipc Shai-Hulud variants.
references:
 - https://securityaffairs.com/192598/malware/security-affairs-malware-newsletter-round-98.html
author: Security Arsenal
date: 2025/03/01
tags:
 - attack.execution
 - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts (verify script path)
level: high
---
title: GitHub Actions Runner Suspicious Command Execution
id: 9b5g2d34-0c6f-5e23-b9d6-2e3f4a5c6d7b
status: experimental
description: Detects the GitHub Actions Runner worker executing unexpected shell commands or encoded payloads, indicating a compromised Action like issues-helper.
references:
 - https://securityaffairs.com/192598/malware/security-affairs-malware-newsletter-round-98.html
author: Security Arsenal
date: 2025/03/01
tags:
 - attack.execution
 - attack.t1059.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - 'Runner.Worker'
      - 'bin/Runner.Worker'
    Image|endswith:
      - '/bin/bash'
      - '/bin/sh'
      - '/bin/python'
    CommandLine|contains:
      - 'curl'
      - 'wget'
      - 'base64'
  condition: selection
falsepositives:
  - Legitimate CI/CD build steps using curl/wget
level: high
---
title: Node.js Process Network Connection to Non-Standard Port
id: 1c6h3e45-1d7g-6f34-c0e7-3f4a5b6d7e8c
status: experimental
description: Detects node.exe establishing network connections on high ports or non-HTTPS ports, typical of C2 beacons or crypto-miners.
references:
 - https://securityaffairs.com/192598/malware/security-affairs-malware-newsletter-round-98.html
author: Security Arsenal
date: 2025/03/01
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    DestinationPort|notin:
      - 80
      - 443
      - 8080
  condition: selection
falsepositives:
  - Local development servers (e.g., React/Vite dev servers)
level: medium

// Hunt for suspicious npm install activity followed by network connections
let SuspiciousParents = dynamic(['node.exe', 'npm.cmd', 'yarn.cmd', 'pnpm.cmd']);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in (SuspiciousParents)
| where FileName in ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'curl.exe', 'wget.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath
| extend CommandLineHash = hash_sha256(ProcessCommandLine)
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName in ('node.exe')
    | project DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessCommandLine
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort

-- Hunt for malicious package entries in package-lock. files
SELECT FullPath, Mtime, Size
FROM glob(globs='**/package-lock.')
WHERE 
   -- Read file content and check for known malicious package signatures
   read_file(filename=FullPath) =~ 'node-ipc'
   OR read_file(filename=FullPath) =~ 'actions-cool/issues-helper'
   OR read_file(filename=FullPath) =~ '@antv/g6'

-- Hunt for suspicious .npmrc files being accessed or modified recently
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='*/.npmrc')
WHERE Mtime > now() - 7d

#!/bin/bash

# Audit npm, yarn, and pnpm for malicious packages mentioned in Round 98
# Usage: ./audit_supply_chain.sh

echo "[+] Starting Supply Chain Audit..."

# Check for node-ipc versions (verify specific versions against advisory)
echo "[+] Checking for node-ipc..."
if npm list node-ipc 2>/dev/null | grep -q "node-ipc"; then
    echo "[!] WARNING: node-ipc found. Please verify version immediately against Security Affairs advisory."
    npm ls node-ipc
fi

# Check for @antv packages
echo "[+] Checking for @antv packages..."
if npm list @antv/g6 @antv/g6plot 2>/dev/null | grep -q "@antv"; then
    echo "[!] WARNING: @antv package found. Verify integrity."
    npm ls @antv/g6 @antv/g6plot
fi

echo "[+] Checking GitHub workflows for actions-cool/issues-helper..."
# Scan .github/workflows for the malicious action
if grep -r "actions-cool/issues-helper" .github/workflows/ 2>/dev/null; then
    echo "[!] CRITICAL: actions-cool/issues-helper found in workflows. Replace with trusted alternative immediately."
    grep -rn "actions-cool/issues-helper" .github/workflows/
fi

echo "[+] Audit complete."