Mini Shai-Hulud — TeamPCP npm/PyPI Supply-Chain Worm (CVE-2026-45321)

Looks for: npm/pip as the parent of node/curl/wget reaching GitHub during install. Accomplishes: catches the worm payload firing from a lifecycle hook. FP: legit postinstall scripts fetch from GitHub — verify the URL/script.

// HUNT: Mini Shai-Hulud lifecycle-hook payload (npm/pip -> node/curl -> GitHub)
// MITRE: T1195.002, T1059.007 | CONF: high  FP: low-med  COST: low
// FP NOTES: some legit postinstall scripts fetch from GitHub — verify URL/script content
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(npm|npm-cli|node|pip[0-9.]*|yarn|pnpm)$/i
| FileName=/^(node|curl|wget|bash|sh|powershell)$/i
| CommandLine=/(githubusercontent|api\.github\.com|github\.com\/.+\/(raw|releases))/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: node running a script from node_modules with obfuscation/exec markers. Accomplishes: confirms worm execution. FP: correlate with Q1 + a recent install.

// HUNT: Mini Shai-Hulud worm script from node_modules
// MITRE: T1059.007 | CONF: med-high  FP: low-med  COST: low
// TUNING: correlate with Q1; check for eval/Buffer.from/child_process spawn in the script
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^node$/i
| CommandLine=/node_modules\/.+(postinstall|setup|bundle|index)\.(c?js)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: a process referencing GitHub Actions OIDC env vars (ACTIONS_ID_TOKEN_REQUEST_*) or reading the runner's token endpoint. Accomplishes: the OIDC-theft stage. FP: legit OIDC-using steps — flag non-pipeline processes.

// HUNT: OIDC token extraction from GitHub Actions runner
// MITRE: T1552.007, T1528 | CONF: high  FP: low-med  COST: med
// TUNING: scope to CI runner host group; flag node/python/sh referencing the OIDC token vars
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(ACTIONS_ID_TOKEN_REQUEST_TOKEN|ACTIONS_ID_TOKEN_REQUEST_URL|actions\/oidc|id-token)/i
| FileName=/^(node|python[0-9.]*|bash|sh|curl)$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)

Looks for: writes to IDE / AI-agent config locations (VS Code, Cursor, Claude/Copilot config, .npmrc) by a non-IDE process. Accomplishes: catches the persistence hooks. FP: legit config tooling — correlate with Q1/Q2.

// HUNT: Mini Shai-Hulud IDE / AI-agent persistence hooks
// MITRE: T1554, T1546 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q1/Q2; flag writes by node/python, not the IDE itself
#event_simpleName=/NewExecutableWritten|FileWritten/
| TargetFileName=/(\.vscode|\.cursor|Code\/User\/settings|\.npmrc|\.continue|claude.*config|copilot)/i
| ContextBaseFileName=/^(node|python[0-9.]*|bash|sh)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

Looks for: a destructive command targeting the home directory (the anti-remediation wipe). Accomplishes: catches the dead-man's-switch firing. FP: rare legit cleanup — alert on any hit.

// HUNT: Mini Shai-Hulud dead-man's-switch ($HOME wipe on token revocation)
// MITRE: T1485 | CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(rm\s+-rf\s+(\$HOME|~|\/home\/|\/Users\/)|Remove-Item\s+-Recurse.+(USERPROFILE|HOMEPATH)|rd\s+\/s\s+\/q\s+%USERPROFILE%)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)

Looks for: node contacting registry.npmjs.org / GitHub API outside a sanctioned publish pipeline. Accomplishes: surfaces worm re-publish. FP: legit dev tooling — correlate with Q1/Q3 + non-CI host.

// HUNT: Worm re-publish (node -> npm registry / GitHub API outside a publish pipeline)
// MITRE: T1195.002 | CONF: medium  FP: medium  COST: med
// TUNING: exclude sanctioned publish runners; correlate to Q1/Q3
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(registry\.npmjs\.org|api\.github\.com|uploads\.github\.com)$/i
| ContextBaseFileName=/^(node|npm)$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)