T1552.001: Mini Shai-Hulud Node.js Credential Store Harvesting

Tim Peck@timpeck

•updated Aug 31, 2026•35•2•43

Detects node.js or bun runtime processes accessing known sensitive cloud, CI, and package manager credential files on disk. This behavior is indicative of malicious npm supply chain attacks (e.g., Mini Shai-Hulud) attempting to exfiltrate secrets stored in standard configuration paths.