{"uuid": "90bbe5c3-1e50-41fb-8969-f217bfa54385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45321", "type": "seen", "source": "https://gist.github.com/robertDouglass/69dd090fdfd827d0825bb55787822897", "content": "# Shai-Hulud Detection: Operator Instructions & Research\n\n## Threat Overview\n\n**Shai-Hulud** is a self-replicating npm supply-chain worm first detected in September 2025, with evolved variants continuing through 2026. It autonomously compromises developer environments and CI/CD pipelines to harvest cloud credentials and authentication tokens.\n\n**Latest Activity (August 2026):**\n- May 2026: 170+ npm packages, 404+ malicious versions\n- @antv ecosystem: 639 compromised versions  \n- Copycat variants: `chalk-tempalte`, `@bitwarden/cli` v2026.4.0\n- Affects 25,000+ GitHub repositories\n\n## How Shai-Hulud Works\n\n1. **Install-time execution**: Malicious preinstall hook runs during `npm install`\n2. **Payload delivery**: ~10MB obfuscated Bun JavaScript runtime\n3. **Credential harvesting**: Steals NPM tokens, GitHub tokens (ghp_, gho_), CI/CD secrets\n4. **Persistence**: Drops files into `.claude/` (Claude Code) and VS Code directories\n5. **Propagation**: Republishes compromised packages with same pattern\n\n## Indicators of Compromise (IOCs)\n\n### File IOCs\nIf any of these files exist in your home directory, your machine is likely compromised:\n- `cloud.json` \u2013 exfiltrated cloud credentials\n- `contents.json` \u2013 stolen package contents\n- `environment.json` \u2013 environment variables dump\n- `truffleSecrets.json` \u2013 Truffle framework secrets\n- `bun_environment.js` \u2013 malicious Bun bootstrap script\n\n### Environment/Configuration IOCs\n- `.npmrc` with suspicious auth tokens recently accessed\n- GitHub Actions workflows named `formatter_*` in your repos\n- Unexpected commits with secret exfiltration artifacts\n\n### Package IOCs (Known Compromised)\n- `@bitwarden/cli` \u2265 v2026.4.0\n- `chalk-tempalte` (typosquat of `chalk`)\n- `@antv/*` ecosystem packages (639+ versions)\n- Any package version from May 2026 wave with suspicious preinstall hooks\n\n### Network IOCs\n- RSA-4096 encrypted outbound connections to attacker C2\n- SHA256: `e71ba441d172460c01fdde2c1a9bc80f432456a70b55f625d21aa6ed77e6f49c`\n\n## Detection Script Usage\n\nThe included `shai-hulud-verify.sh` performs 6 critical checks:\n\n1. **Malicious JSON files** \u2013 Scans home directory for exfiltration artifacts\n2. **Bun runtime** \u2013 Flags if Bun is installed (used to bootstrap malware)\n3. **GitHub workflows** \u2013 Searches for secret exfiltration patterns\n4. **Known packages** \u2013 Checks package.json for compromised package versions\n5. **NPM tokens** \u2013 Verifies .npmrc doesn't show unauthorized access\n6. **GitHub tokens** \u2013 Checks environment for exposed GitHub credentials\n\n### Running the Script\n\n```bash\nbash shai-hulud-verify.sh\n```\n\n**Output interpretation:**\n- \u2713 NONE FOUND / NOT installed / No tokens \u2013 **CLEAN**\n- \u26a0 WARNING \u2013 Requires investigation (see below)\n\n## Interpreting Results\n\n### Safe Findings (Green)\n- \u2713 No malicious JSON files\n- \u2713 No GitHub workflow exfiltration\n- \u2713 No compromised packages in package.json\n- \u2713 No GitHub tokens in environment\n- \u2713 Bun not installed (or installed before May 2026)\n\n### Requires Investigation (Yellow)\n- \u26a0 Bun installed: Check installation date (`ls -la $(which bun)`)\n  - **Pre-May 2026**: Likely legitimate\n  - **Post-May 2026**: Verify against attack timeline\n- \u26a0 GitHub workflows flagged: Verify they're in `/go/pkg/mod/`, `node_modules/`, or `.cache/` (dependencies)\n  - Suspicious if in active project repos with secret access\n- \u26a0 NPM token in .npmrc: Rotate it (`npm logout && npm login`)\n\n### Critical Findings (Red)\n- Any malicious JSON files \u2192 Machine is compromised\n- `formatter_*` workflows in active repos \u2192 Investigate immediately\n- Recent suspicious commits with artifact uploads \u2192 Breach likely occurred\n\n## Confidence Ratings\n\n**High Confidence (95%+): NOT AFFECTED**\n- No malicious JSON files found\n- No exfiltration artifacts\n- No suspicious workflow patterns in active repos\n- Bun predates attack waves OR not installed\n\n**Medium Confidence (70-85%): LIKELY NOT AFFECTED**\n- Bun installed during attack window but no other IOCs\n- Suspicious workflows only in dependency caches\n- NPM token exists but no unauthorized access\n\n**Low Confidence (<70%): REQUIRES ESCALATION**\n- Multiple IOCs present\n- Suspicious recent commits\n- Unknown installation patterns\n\n## Response Procedures\n\n### If NOT Affected\n1. Rotate npm token (precautionary): `npm logout && npm login`\n2. Enable GitHub secret scanning: Settings \u2192 Security\n3. Audit recent `npm install` commands against Cirosec IOC list\n4. Review GitHub Actions logs for unauthorized access\n\n### If Possibly Affected\n1. **ISOLATE**: Disconnect from network\n2. **PRESERVE**: Don't delete suspected files; preserve for forensics\n3. **ESCALATE**: Report to security team with findings\n4. **ROTATE**: All tokens/credentials (after isolation)\n5. **AUDIT**: Review git history for backdoors\n6. **REBUILD**: Consider fresh OS install if critical system\n\n### If Definitely Affected\n1. **INCIDENT**: Declare security incident\n2. **CONTAINMENT**: Isolate all development machines\n3. **FORENSICS**: Preserve logs and artifacts\n4. **RESPONSE**: Follow incident response plan\n5. **REMEDIATION**: Rotate all compromised credentials org-wide\n\n## Research Sources\n\n### Primary Research\n- **Cirosec**: [A Collection of Shai-Hulud 2.0 IoCs](https://cirosec.de/en/news/a-collection-of-shai-hulud-2-0-iocs/)\n- **Wiz**: [Shai-Hulud 2.0 Supply Chain Attack](https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack)\n- **Sysdig**: [25,000+ GitHub Repositories Affected](https://www.sysdig.com/blog/return-of-the-shai-hulud-worm-affects-over-25-000-github-repositories)\n- **Phoenix Security**: [Full Technical Dissection](https://phoenix.security/sha1-hulud-shai-hulud-worm-analysis-persistence-iocs/)\n\n### Security Advisories\n- **Microsoft**: [Mini Shai-Hulud & @antv Compromise](https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/)\n- **Unit 42 (Palo Alto)**: [npm Supply Chain Attack Overview](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/)\n- **Tenable**: [Mini Shai-Hulud FAQ](https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions)\n- **Trend Micro**: [npm Supply Chain & Cloud-Targeted Variants](https://www.trendmicro.com/en_us/research/25/i/npm-supply-chain-attack.html)\n\n### Detection Tools\n- **GitHub**: [shai-hulud-detect](https://github.com/Cobenian/shai-hulud-detect) \u2013 Detection tool with per-wave IOCs\n- **Wiz**: [wiz-research-iocs](https://github.com/wiz-sec-public/wiz-research-iocs/) \u2013 CSV of impacted packages\n\n## CVE Reference\n- **CVE-2026-45321**: Mini Shai-Hulud (@antv compromise variant)\n\n---\n\n**Last Updated:** August 5, 2026  \n**Script Version:** 1.0  \n**Threat Level:** ACTIVE (Recent waves detected through August 2026)\n", "creation_timestamp": "2026-08-05T20:22:11.320870Z"}