Alert: 'mini Shai-Hulud' Campaign Targets SAP npm Packages

We're using an internal proxy (Artifactory) for all npm traffic, which blocks anything not explicitly whitelisted. This usually stops the dependency confusion attacks, but typosquatting still slips through if a dev manually installs a malicious package.

We've also started running npm ci in isolated containers to test behavior before merging. I'd suggest checking your CI/CD logs for any npm install commands that ran outside of the build agents recently.

Good call on the postinstall check. We implemented a KQL rule in our SIEM to look for Node.js spawning immediately after package management tools, which often indicates a script execution.

Here is the basic query if it helps:

ProcessCreationEvents
| where FileName in ('node.exe', 'node')
| where ParentProcessName has 'npm' or ParentProcessName has 'yarn'
| project Timestamp, DeviceName, FileName, CommandLine

Better to catch it at the network layer, but this helps if the package is already internal.

This reinforces the need for signed commits and provenance. We are looking at implementing Sigstore/TPM policies for our internal SAP team.

If you aren't already, use npm audit --audit-level=moderate as a pre-commit hook. It won't catch zero-days in new packages, but it helps keep the known supply chain noise down.

Excellent insights. Beyond auditing, detecting obfuscated payloads is crucial since many of these attacks use hidden base64 strings to evade initial scans. I suggest implementing a high-entropy check in your CI pipeline to flag suspicious code in node_modules.

Here is a quick Python snippet to identify potential obfuscation:

import math, sys

def check_entropy(filename, threshold=4.5):
    with open(filename, 'rb') as f:
        data = f.read()
    counts = [0] * 256
    for byte in data:
        counts[byte] += 1
    entropy = -sum((c / len(data)) * math.log2(c / len(data)) for c in counts if c)
    if entropy > threshold:
        print(f'High entropy in {filename}: {entropy}')

Great points on runtime monitoring. To catch these earlier in the pipeline, we scan node_modules for obfuscated scripts immediately after npm install. Specifically, looking for decoding functions within dependency package. files helps identify hidden payloads. You can run this simple check in CI to flag potential malware before execution:

grep -rE "(atob|btoa|Buffer\.from)" node_modules/*/package.


It catches a lot of obfuscated logic that standard audits might miss.