Leonardo Gasparini
@Leonardo.Gasparini2 followers204 downloads93 copies5 likes7,170 views
16 detections
Filters
Last updated
All Time
Detection languages
14
2
Categories
6
6
2
2
2
Platforms
9
7
2
2
Products / Services
2
2
2
2
1
MITRE Techniques
7
7
7
6
6
Detects creation of AI coding assistant configuration files used by the Miasma worm
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
Detects the Miasma worm kill chain triggered via binding.gyp during npm install. The attack
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
Detects network connections from Bun or Node.js processes to GitHub API endpoints
used by the Miasma worm for credential exfiltration. The malware creates repos under
the liuende501 account and uploads encrypted stolen credentials.
used by the Miasma worm for credential exfiltration. The malware creates repos under
the liuende501 account and uploads encrypted stolen credentials.
Detects attempts to read Runner.Worker process memory to extract GitHub Actions secrets
in their unmasked form. The Miasma worm uses sudo python3 to escalate privileges and
read /proc/<PID>/mem, then pipes through grep to extract secret values.
in their unmasked form. The Miasma worm uses sudo python3 to escalate privileges and
read /proc/<PID>/mem, then pipes through grep to extract secret values.
Detects Bun or Node.js processes spawned from temporary directories making requests
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects network connections to the Session P2P exfiltration infrastructure used by the Mini Shai-Hulud campaign.
Detects process execution patterns associated with the Mini Shai-Hulud malware, including lifecycle hook
execution, daemonized Node.js processes, and PyPI payload execution.
execution, daemonized Node.js processes, and PyPI payload execution.
Detects Node.js or Bun processes making HTTP requests to AWS IMDS or ECS metadata endpoints,
indicative of credential harvesting by the Mini Shai-Hulud malware.
indicative of credential harvesting by the Mini Shai-Hulud malware.
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign.
The domain git-tanstack.com is attacker-controlled. The filev2.getsession.org endpoint is used
for credential exfiltration via the Session protocol.
The domain git-tanstack.com is attacker-controlled. The filev2.getsession.org endpoint is used
for credential exfiltration via the Session protocol.
Page 1 of 2