Jeff Daisley
@JDaisleyPhiladelphia, PATrusted contributorCompletionist
0 followers264 downloads44 copies0 likes296 views
20 detections
Filters
Last updated
All Time
Detection languages
12
8
Categories
3
3
3
3
3
Platforms
6
3
3
2
Products / Services
3
3
2
MITRE Techniques
3
3
3
3
3
IDS Classtypes
5
3
IDS Protocols
5
2
1
Detects ChainDrop/Shai-Hulud 2.0 npm supply-chain worm preinstall dropper (setup.mjs) injected into keyv, cacheable, flat-cache, file-entry-cache and hundreds of downstream packages on 2026-08-04. Matches by hash and by behavioral strings. Hash IOCs are perishable because the attacker re-obfuscates per wave; the Bun download URL, staging-directory prefix, and payload filenames provide more durable coverage.
ChainDrop Mini Shai-Hulud npm supply-chain worm C2 infrastructure DNS lookup
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
ChainDrop Shai-Hulud npm Worm C2 beacon POST /router Bun/1.3.13 UA to npm-cache.com
Detects ChainDrop/Mini Shai-Hulud npm worm preinstall dropper (setup.mjs) injected into trojanized npm packages including keyv, cacheable, and flat-cache
Detects ChainDrop / Shai-Hulud 2.0 self-propagating npm credential-harvesting worm deployed via keyv/cacheable supply-chain compromise. Matches exact hashes or a combination of unique embedded strings including the dead-man's-switch extortion string, runner-memory secret scrape marker, Ethereum dead-drop repo banner, npm whoami exfil endpoint, fallback commit token, and persistence dropper path.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects ChainDrop/Shai-Hulud 2.0 npm worm cross-referencing IDE persistence hooks: Claude Code SessionStart hooks invoking node .vscode/setup.mjs, VS Code folderOpen tasks invoking node .claude/setup.mjs, or payload dropper files referencing both sides of the chain.
Detects ChainDrop/Mini Shai-Hulud npm worm preinstall dropper (setup.mjs) injected into trojanized npm packages including keyv, cacheable, and flat-cache
Page 1 of 2