Shai-Hulud: Self-Replicating npm Post-Install Worm Harvesting CI/CD Secrets
A routine dependency bump on a shared Linux CI runner pulls a trojanized npm package whose postinstall hook runs a bundled worm. The worm harvests GitHub, npm, and cloud credentials from the filesystem and the Instance Metadata Service, verifies them with TruffleHog, exfiltrates the loot to a free webhook dropbox, then reuses the stolen tokens to flip private repositories public as '-migration' clones, create a public Shai-Hulud loot repository, and republish itself into the organization's own packages. Reconstruct the self-replicating supply chain compromise from endpoint XDR and egress firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the file the install executed
40Every later event traces back to one script that ran during the dependency install. Identify the file the package's lifecycle hook executed.
Recover the payload's huntable indicator
40Pin down the file-level indicator for the worm so it can be swept across every runner and developer machine. Provide the SHA-256 of the bundled script.
Classify the install-time execution
35The payload ran with no user interaction beyond pulling a dependency. Identify the MITRE ATT&CK technique for how the supply chain delivered the code.
Separate the exfiltration from the build traffic
40The worm sent the harvested credentials somewhere no build job should. Identify the external host that received the exfiltrated secrets.
Classify the metadata-service credential theft
35Beyond the filesystem, the worm pulled cloud role credentials from one specific endpoint. Classify that credential-access technique.
Recover the leaked private repository
35The stolen GitHub token was used to expose source code in the open. Identify the public clone the worm created from a private repository.
Classify the self-propagation step
35The worm did more than steal, it spread itself further down the supply chain. Identify the technique for how it re-entered the ecosystem.
8 tasks · 260 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allIvanti CSA Exploit Chain: Auth Bypass + SQLi/Command Injection to Webshell
A suspected nation-state operator chained four Ivanti Cloud Services Appliance zero-days against an internet-facing appliance: an unauthenticated path-traversal auth bypass, command injection in the date/time and reporting handlers for root-level execution, PHP webshells for persistence, theft of the appliance administrator password and root SSH key, and a SQL-injection pivot to a backend SQL Server via xp_cmdshell. Reconstruct the full chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key techniques.
Akira Ransomware: Full Kill Chain IR
The intrusion began with a search engine advertisement and ended with the deployment of Akira ransomware. This scenario covers the full 2025 threat landscape, emphasizing identity-based compromise, MFA bypass via AiTM kits, and rapid lateral movement toward Active Directory. Analysts must navigate a complex environment of Windows workstations, Domain Controllers, and Cisco VPN infrastructure to reconstruct the timeline from initial access to data exfiltration and final encryption.
Black Basta: Email Bomb to Encryption
Investigate a Black Basta-style ransomware intrusion that begins with email bombing and Microsoft Teams impersonation, escalates through Quick Assist remote control, establishes BackConnect-style command and control through OneDrive DLL side-loading, exfiltrates data with WinSCP, and ends in ransomware encryption. Correlate SIEM, XDR, and firewall telemetry carefully: external C2 IPs identify adversary infrastructure, while internal srcIp values identify compromised hosts. Note: there is no separate email console in this operation - all mail-gateway telemetry for the email-bombing wave lives in the SIEM logs (source: email-gateway), alongside Windows, IDS, EDR, and Azure AD events.