Canister -
@CanisterCompletionist
3 followers5 downloads329 copies4 likes8,943 views
13 detections
Filters
Last updated
All Time
Detection languages
13
Categories
1
Platforms
1
MITRE Techniques
5
4
4
3
3
CVEs
1
The "Miasma" npm supply chain attack exploits native build processes using a weaponized binding.gyp file to execute self-propagating malware and steal CI/CD credentials. This worm automates the infection of dozens of packages by bypassing security scanners, targeting cloud secrets, and forging provenance
Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Attackers distributed a malicious MSI installer disguised as a legitimate Sysinternals tool. Once executed, it installed EtherRAT, a Node.js-based remote access trojan. EtherRAT then deployed TukTuk C2, a framework designed to abuse SaaS services (Supabase, ClickHouse, Dropbox, GitHub Issues) and Cloudflare tunnels for resilient command-and-control.
Ref: https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
Ref: https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
This query is a security detection rule: it flags when image file operations occur in tandem with executable file operations, which is often a sign of potential malware or intrusion activity.
The “YellowKey” vulnerability disclosed on May 12, 2026, allows attackers with physical access to bypass BitLocker encryption on Windows 11 and Windows Server 2022/2025, gaining full access to protected data without a recovery key or PIN. Microsoft has not yet confirmed the issue or released a patch.
Ref: https://blackfort-tec.de/en/insights/yellowkey-bitlocker-bypass-windows-11-vulnerability
Ref: https://blackfort-tec.de/en/insights/yellowkey-bitlocker-bypass-windows-11-vulnerability
Attackers distributed a malicious MSI installer disguised as a legitimate Sysinternals tool. Once executed, it installed EtherRAT, a Node.js-based remote access trojan. EtherRAT then deployed TukTuk C2, a framework designed to abuse SaaS services (Supabase, ClickHouse, Dropbox, GitHub Issues) and Cloudflare tunnels for resilient command-and-control.
https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
A large-scale supply-chain attack where 84 compromised npm package artifacts in the tanstack namespace were modified with credential-stealing malware. The incident is tracked as part of the ongoing Mini Shai-Hulud campaign.
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
RedSun Detection
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Page 1 of 2