Jeff Daisley
@JDaisleyPhiladelphia, PATrusted contributorCompletionist
0 followers264 downloads44 copies0 likes296 views
20 detections
Filters
Last updated
All Time
Detection languages
12
8
Categories
3
3
3
3
3
Platforms
6
3
3
2
Products / Services
3
3
2
MITRE Techniques
3
3
3
3
3
IDS Classtypes
5
3
IDS Protocols
5
2
1
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
Detects ChainDrop/Shai-Hulud 2.0 npm supply-chain worm preinstall dropper (setup.mjs) injected into keyv, cacheable, flat-cache, file-entry-cache and hundreds of downstream packages on 2026-08-04. Matches by hash and by behavioral strings. Hash IOCs are perishable because the attacker re-obfuscates per wave; the Bun download URL, staging-directory prefix, and payload filenames provide more durable coverage.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
ChainDrop Mini Shai-Hulud npm supply-chain worm C2 infrastructure DNS lookup
ChainDrop Shai-Hulud 2.0 npm worm C2 TLS SNI npm-cache.com
ChainDrop Shai-Hulud 2.0 EtherHiding C2 Domain Lookup via eth_call
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
ChainDrop Shai-Hulud npm Worm C2 beacon POST /router Bun/1.3.13 UA to npm-cache.com
Page 2 of 2