TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Trend Micro Research

What We Know About the NPM Supply Chain Attack

Joshua Aquino · 2025-09-18 · Read original ↗

ATT&CK techniques detected

22 predictions
T1195.001Compromise Software Dependencies and Development Tools
100%
"assets the attackers hijacked web apis and manipulated network traffic as a means of covertly diverting funds from legitimate channels to wallets they controlled, targeting both organizations and end - users interacting with compromised packages. shai - hulud attack chain analysi…"
T1195.001Compromise Software Dependencies and Development Tools
99%
"experienced an ongoing supply chain attack, in which the attackers executed a highly targeted phishing campaign to compromise the account of an npm package maintainer. with privileged access, the attackers injected malicious code into widely used javascript packages, threatening …"
T1195.001Compromise Software Dependencies and Development Tools
98%
"what we know about the npm supply chain attack key takeaways - attackers reportedly launched a targeted phishing campaign to compromise node package manager ( npm ) maintainer accounts and inject malicious code into widely used javascript packages. - certain malicious packages co…"
T1195.001Compromise Software Dependencies and Development Tools
97%
"minimal effort from the attacker once deployed. what makes shai - hulud distinctive? traditional software supply chain threats typically involve single - use payloads or targeted credential theft. shai - hulud distinguishes itself through its ability to self - replicate within th…"
T1195.001Compromise Software Dependencies and Development Tools
97%
"propagation mechanism centers around malicious post - install scripts. when an infected package is deployed, arbitrary code executes, which may download further payloads or inject malicious scripts into other projects and dependencies. - network activity - the worm can communicat…"
T1195.001Compromise Software Dependencies and Development Tools
92%
"establish persistence and start stealing information. using stolen github access tokens, the malware authenticated to the github api, checked user permissions, and listed all repositories the victim could access – including private ones. it cloned private repositories to attacker…"
T1587Develop Capabilities
88%
"minimal effort from the attacker once deployed. what makes shai - hulud distinctive? traditional software supply chain threats typically involve single - use payloads or targeted credential theft. shai - hulud distinguishes itself through its ability to self - replicate within th…"
T1195.001Compromise Software Dependencies and Development Tools
85%
"been affected so far based on trend ' s telemetry, attacks involving the cryptohijacker payload have been reported across various countries, but primarily in north america and europe. organizations and developers that depend on widely adopted javascript libraries are among those …"
T1587Develop Capabilities
85%
"assets the attackers hijacked web apis and manipulated network traffic as a means of covertly diverting funds from legitimate channels to wallets they controlled, targeting both organizations and end - users interacting with compromised packages. shai - hulud attack chain analysi…"
T1587Develop Capabilities
77%
"propagation mechanism centers around malicious post - install scripts. when an infected package is deployed, arbitrary code executes, which may download further payloads or inject malicious scripts into other projects and dependencies. - network activity - the worm can communicat…"
T1587Develop Capabilities
75%
"experienced an ongoing supply chain attack, in which the attackers executed a highly targeted phishing campaign to compromise the account of an npm package maintainer. with privileged access, the attackers injected malicious code into widely used javascript packages, threatening …"
T1567.001Exfiltration to Code Repository
74%
"repository, the worm creates a corresponding destination repository in the attacker ’ s account – embedding an identifier in the repository description such as “ shai - hulud migration ” for tracking ( figure 12 ). once created, what was a private repository in the victim ’ s org…"
T1213.003Code Repositories
73%
"repository, the worm creates a corresponding destination repository in the attacker ’ s account – embedding an identifier in the repository description such as “ shai - hulud migration ” for tracking ( figure 12 ). once created, what was a private repository in the victim ’ s org…"
T1213.003Code Repositories
62%
"establish persistence and start stealing information. using stolen github access tokens, the malware authenticated to the github api, checked user permissions, and listed all repositories the victim could access – including private ones. it cloned private repositories to attacker…"
T1195.001Compromise Software Dependencies and Development Tools
55%
"repository, the worm creates a corresponding destination repository in the attacker ’ s account – embedding an identifier in the repository description such as “ shai - hulud migration ” for tracking ( figure 12 ). once created, what was a private repository in the victim ’ s org…"
T1195.001Compromise Software Dependencies and Development Tools
49%
"##thub authentication tokens to confirm the ability to interact with the api. by issuing api requests such as / user / repos? affiliation = owner, collaborator, organization _ member & since = 2025 - 01 - 01t00 : 00 : 00z & per _ page = 100, the worm identifies repositories where…"
T1593.003Code Repositories
44%
"repository, the worm creates a corresponding destination repository in the attacker ’ s account – embedding an identifier in the repository description such as “ shai - hulud migration ” for tracking ( figure 12 ). once created, what was a private repository in the victim ’ s org…"
T1195.001Compromise Software Dependencies and Development Tools
41%
"propagation and secret exfiltration across an organization ’ s development environment. upon execution, shai - hulud prepares the following : - assigns a branch name such as shai - hulud to maintain consistency and help track infections across repositories. - targets. github / wo…"
T1195.002Compromise Software Supply Chain
37%
"establish persistence and start stealing information. using stolen github access tokens, the malware authenticated to the github api, checked user permissions, and listed all repositories the victim could access – including private ones. it cloned private repositories to attacker…"
T1567.001Exfiltration to Code Repository
33%
"establish persistence and start stealing information. using stolen github access tokens, the malware authenticated to the github api, checked user permissions, and listed all repositories the victim could access – including private ones. it cloned private repositories to attacker…"
T1204.005Malicious Library
32%
"propagation mechanism centers around malicious post - install scripts. when an infected package is deployed, arbitrary code executes, which may download further payloads or inject malicious scripts into other projects and dependencies. - network activity - the worm can communicat…"
T1213.003Code Repositories
30%
"##thub repositories from an organization to an attacker ’ s infrastructure. the following section outlines the programmatic stages of this cloning activity. the main orchestration logic coordinates the full cloning cycle – from initialization through repository creation and expos…"

Summary

Trend™ Research outlines the critical details behind the ongoing NPM supply chain attack and offers essential steps to stay protected against potential compromise.