attack.t1195.002

TanStack Supply-Chain Attack File Creation Indicators - Linux

Jul 9, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.t1059.007 attack.persistence attack.privilege-escalation attack.t1547.004 detection.emerging-threats ·

Share on:

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

TanStack Supply-Chain Attack File Creation Indicators - Windows

Jul 9, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.t1059.007 attack.persistence attack.t1554 detection.emerging-threats ·

Share on:

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.

Axios NPM Compromise Indicators - Linux

Apr 28, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.t1059.006 attack.t1059.004 attack.t1105 detection.emerging-threats ·

Share on:

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Axios NPM Compromise Indicators - macOS

Apr 28, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.t1059.002 attack.t1059.004 attack.t1105 detection.emerging-threats ·

Share on:

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

Axios NPM Compromise Indicators - Windows

Apr 28, 2026 · attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.t1059.003 attack.t1059.005 attack.t1105 detection.emerging-threats ·

Share on:

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

Notepad++ Updater DNS Query to Uncommon Domains

Apr 21, 2026 · attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557 ·

Share on:

Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.

Uncommon File Created by Notepad++ Updater Gup.EXE

Apr 21, 2026 · attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557 ·

Share on:

Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.

LiteLLM / TeamPCP Supply Chain Attack Indicators

Apr 1, 2026 · attack.initial-access attack.t1195.002 attack.collection attack.t1560.001 attack.persistence attack.privilege-escalation attack.t1543.002 detection.emerging-threats ·

Share on:

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

TeamPCP LiteLLM Supply Chain Attack Persistence Indicators

Apr 1, 2026 · attack.persistence attack.privilege-escalation attack.t1543.002 attack.initial-access attack.t1195.002 detection.emerging-threats ·

Share on:

Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack. In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

Axios NPM Compromise File Creation Indicators - Linux

Apr 1, 2026 · attack.initial-access attack.t1195.002 attack.command-and-control attack.t1105 detection.emerging-threats ·

Share on:

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

Axios NPM Compromise File Creation Indicators - MacOS

Apr 1, 2026 · attack.initial-access attack.t1195.002 attack.command-and-control attack.t1105 detection.emerging-threats ·

Share on:

Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

Axios NPM Compromise File Creation Indicators - Windows

Apr 1, 2026 · attack.initial-access attack.t1195.002 detection.emerging-threats ·

Share on:

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

Shai-Hulud 2.0 Malicious NPM Package Installation

Mar 29, 2026 · attack.initial-access attack.execution attack.t1195.002 detection.emerging-threats ·

Share on:

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

Shai-Hulud 2.0 Malicious NPM Package Installation - Linux

Mar 29, 2026 · attack.initial-access attack.execution attack.t1195.002 detection.emerging-threats ·

Share on:

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

Shai-Hulud Malicious Bun Execution

Mar 29, 2026 · attack.t1195.002 attack.t1203 attack.execution attack.initial-access detection.emerging-threats ·

Share on:

Detects the execution of bun_environment.js via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a setup_bun.js script to install the Bun runtime if not present, and then executes the malicious bun_environment.js payload.

Shai-Hulud Malicious Bun Execution - Linux

Mar 29, 2026 · attack.t1195.002 attack.t1203 attack.execution attack.initial-access detection.emerging-threats ·

Share on:

Detects the execution of bun_environment.js via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a setup_bun.js script to install the Bun runtime if not present, and then executes the malicious bun_environment.js payload.

Suspicious Child Process of Notepad++ Updater - GUP.Exe

Feb 4, 2026 · attack.collection attack.credential-access attack.t1195.002 attack.initial-access attack.t1557 ·

Share on:

Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.