Full Report
Researchers identified a broad TeamPCP-linked supply chain campaign involving malicious NPM packages, compromised GitHub Actions, a trojanized VSCode extension, and malicious PyPI packages targeting cloud and CI/CD environments. The campaign includes large-scale credential the...
Analysis Summary
# Incident Report: Mini-Shai-Hulud Supply Chain Campaign
## Executive Summary
Researchers identified a sophisticated multi-wave supply chain campaign orchestrated by TeamPCP targeting cloud and CI/CD environments via NPM, PyPI, and VSCode extensions. The attack involved large-scale credential theft, the establishment of persistent backdoors, and lateral movement into AWS and Kubernetes environments. The campaign was notable for its use of orphaned GitHub commits for payload delivery and a destructive "wiper" routine triggered by specific geofencing conditions.
## Incident Details
- **Discovery Date:** May 18, 2026
- **Incident Date:** May 18 – May 19, 2026
- **Affected Organization:** Users of Alibaba AntV (initial wave) and Microsoft `durabletask` (second wave)
- **Sector:** Software Development / Technology
- **Geography:** Global (with targeted logic for Israel and Iran)
## Timeline of Events
### Initial Access
- **Date/Time:** May 18, 2026
- **Vector:** Supply Chain Compromise (NPM/PyPI/VSCode)
- **Details:** Dozens of malicious NPM packages and a trojanized VSCode extension were published. These packages used `bun` to install malware and downloaded secondary payloads from orphaned GitHub commits.
### Lateral Movement
- **Cloud/K8s Probing:** The malware utilized `kubectl exec` to attempt movement within Kubernetes clusters and abused AWS Systems Manager (SSM) `SendCommand` functionality to propagate payloads to EC2 instances.
### Data Exfiltration/Impact
- **Credential Harvesting:** Systematic theft of credentials from developer environments.
- **Exfiltration Method:** RSA-encrypted data was exfiltrated by creating public GitHub repositories with the reversed description: `"niagA oG eW ereH :duluH-iahS"`.
- **Destructive Activity:** Implementation of a conditional `rm -rf /*` routine targeting specific geolocations.
### Detection & Response
- **Discovery:** Identified by security researchers monitoring package repository anomalies and GitHub commit patterns.
- **Response Actions:** Malicious packages were flagged for removal from NPM and PyPI; investigation into compromised GitHub Actions and repositories.
## Attack Methodology
- **Initial Access:** Publishing trojanized NPM/PyPI packages and a VSCode extension.
- **Persistence:** Installation of a Python backdoor (`cat.py`) at `~/.local/share/kitty/cat.py` and persistence scripts at `/usr/bin/pgmonitor.py`.
- **Defense Evasion:** Payloads hosted in orphaned GitHub commits; conditional execution based on geolocation.
- **Credential Access:** Automated harvesting of local environment variables and cloud provider credentials.
- **Discovery:** Scanning for `kubectl` configurations and AWS environment metadata.
- **Lateral Movement:** AWS SSM `SendCommand` and `kubectl` execution.
- **Exfiltration:** Creating public GitHub repositories to exfiltrate encrypted data.
- **Impact:** Potential for total system wipe (`rm -rf /*`) under specific conditions.
## Impact Assessment
- **Financial:** High potential loss due to cloud credential theft and resource hijacking.
- **Data Breach:** Large-scale theft of developer and environment credentials.
- **Operational:** Disruption of CI/CD pipelines and potential catastrophic data loss via wiper functionality.
- **Reputational:** Significant impact on the trust of widely used open-source libraries.
## Indicators of Compromise
- **Network Indicators:**
- `hxxp[://]check[.]git-service[.]com`
- Polling for commands containing `firedalazer` on GitHub.
- **File Indicators:**
- `~/.local/share/kitty/cat.py`
- `/usr/bin/pgmonitor.py`
- `~/.local/bin/pgmonitor.py`
- `rope.pyz`
- **Behavioral Indicators:**
- Unexpected creation of public GitHub repositories with the description "niagA oG eW ereH :duluH-iahS".
- Unauthorized `aws ssm send-command` or `kubectl exec` activity.
## Response Actions
- **Containment:** Removal of malicious versions of `durabletask` and related NPM packages.
- **Eradication:** Deletion of unauthorized GitHub repositories used for exfiltration; rotation of all potentially exposed AWS and K8s credentials.
- **Recovery:** Restoration of developer environments from known-good backups where wiper logic was triggered.
## Lessons Learned
- **Orphaned Commits:** Attackers are increasingly using orphaned GitHub commits to host "invisible" malicious payloads that do not appear in the main branch history.
- **Dependency Trust:** Official packages (like Microsoft's `durabletask`) can be compromised, highlighting the need for checksum verification and version pinning.
- **Geofenced Malware:** The presence of regional-specific destructive logic suggests highly targeted geopolitical motivations within broader campaigns.
## Recommendations
- **CI/CD Security:** Implement strict egress filtering for CI/CD runners to prevent unauthorized communication with external domains or GitHub repository creation.
- **Credential Protection:** Use Short-Lived Credentials (STS) rather than long-term IAM keys to minimize the window of opportunity for stolen credentials.
- **Monitoring:** Monitor for anomalous Python processes (`pgmonitor.py`) and unexpected GitHub activity within the organization's ecosystem.