TeamPCP supply chain campaign enters copycat phase via npm worm
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Leaked Mini Shai-Hulud framework spawns credential-stealing npm worms compromising Red Hat and Vapi packages with valid but poisoned build signatures.
The TeamPCP supply chain campaign has entered a new phase following the public release of its Mini Shai-Hulud framework: attackers—possibly unaffiliated with the original operators—have launched two major npm compromise waves using subverted build pipelines. Beginning 2026-06-01, a credential-stealing worm named "Miasma" compromised at least 32 @redhat-cloud-services packages across 90+ versions by hijacking a Red Hat employee GitHub account and injecting malicious GitHub Actions workflows. Two days later, the "Phantom Gyp" variant compromised 57 additional packages across 286+ versions in under two hours by weaponizing binding.gyp files to evade install-time monitoring focused only on package.json scripts. Both attacks delivered validly signed SLSA provenance attestations because the build pipelines themselves were subverted from within—a critical reminder that provenance signatures do not protect against compromised build environments. The affected packages included the official Vapi.ai server SDK with over 408,000 monthly downloads. Attribution is now ambiguous: vendors explicitly caution the copycat risk, noting that direct linkage to TeamPCP operators cannot be assumed. CISA added three tracking CVEs to its Known Exploited Vulnerabilities catalog on 2026-05-27 with a 2026-06-10 remediation deadline and published a standalone advisory on 2026-05-28 covering the Nx Console poisoning and GitHub repository exfiltration.
Mentioned in this report
Detection guidance
Node.js Process Writing GitHub Actions Workflow File
node.exe creating or modifying files under .github/workflows, consistent with an npm worm injecting malicious GitHub Actions workflows into repositories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Writing GitHub Actions Workflow File
id: 830df43a-497e-5ba0-9674-bf33c33dabfd
status: experimental
description: Detects node.exe writing YAML files into a .github\workflows directory.
Self-propagating npm worms (Miasma-style) inject malicious GitHub Actions workflows
using hijacked developer credentials to subvert build pipelines. Generalises on
the writer process and target directory, not on workflow filenames.
tags:
- attack.initial-access
- attack.t1195.001
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \node.exe
TargetFilename|contains: \.github\workflows\
TargetFilename|endswith:
- .yml
- .yaml
condition: selection
falsepositives:
- Developer scaffolding tools (project generators, release tooling) that legitimately
create CI workflow files via Node.js
- Dependabot-style or repo-management scripts run locally by developers
level: medium
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33060
Node.js Spawning Windows Shell With Download or Encoded Command
node.exe (npm install/postinstall or node-gyp context) spawning cmd/PowerShell with download cradles or encoded commands, as used by malicious npm package install-time payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Spawning Windows Shell With Download or Encoded Command
id: e6f7e28f-a37c-55cb-a5b0-2e7ace0754de
status: experimental
description: Detects node.exe spawning cmd.exe or PowerShell whose command line contains
download cradles or encoded-command flags. Malicious npm packages (package.json
scripts or weaponised binding.gyp builds) use this to fetch and run payloads at
install time. Generalises on the parent/child relation and download tooling, not
on package names.
tags:
- attack.initial-access
- attack.t1195.001
- attack.stealth
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \node.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains:
- DownloadString
- DownloadFile
- Invoke-WebRequest
- Invoke-Expression
- iwr
- FromBase64String
- ' -enc'
- certutil
- bitsadmin
- 'curl '
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legitimate npm postinstall scripts that download prebuilt binaries via curl or PowerShell
- Developer build scripts invoking PowerShell web requests from Node.js tooling
level: medium
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33060
Node.js Spawning Shell Piping Remote Download to Interpreter on Linux
node spawning sh/bash that uses curl or wget piped into a shell, typical of malicious npm install-time scripts on Linux build hosts and CI runners. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Spawning Shell Piping Remote Download to Interpreter on Linux
id: 24612747-818e-511f-9c85-542746198800
status: experimental
description: Detects a node process spawning a POSIX shell whose command line downloads
content with curl or wget and pipes it into sh or bash. Seen in compromised npm
packages that execute payloads during install on developer machines and CI runners.
Generalises on the parent/child relation and pipe-to-shell pattern.
tags:
- attack.initial-access
- attack.t1195.001
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /node
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_download:
CommandLine|contains:
- 'curl '
- 'wget '
selection_pipe:
CommandLine|contains:
- '| sh'
- '| bash'
- '|sh'
- '|bash'
condition: selection_parent and selection_child and selection_download and selection_pipe
falsepositives:
- Node-based installers or version managers that pipe an install script into a shell
- Internal build scripts run through npm that bootstrap tooling with curl piped to
bash
level: high
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33060
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33060
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs