Tensorlake npm Compromise (Shai-Hulud): Payload, Token Monitor and C2 Hunt

Goksel Atakan@gokselatakan

•updated yesterday•2•1•13

Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.