Microsoft Security recently detailed a campaign involving typosquatted npm packages designed to steal cloud and CI/CD secrets, a critical supply chain compromise (T1195.002). This activity leverages npm lifecycle hooks (T1059.007) to execute malicious code, ultimately targeting cloud credentials (T1552.009) and establishing command and control (T1071.001) via custom HTTP headers. Our analysis focused on generating high-fidelity detections for these specific tactics.
We developed several KQL queries leveraging DeviceProcessEvents and DeviceNetworkEvents to identify this activity. One query targets the initial execution, looking for `node.exe`, `npm.exe`, or `npx.exe` processes executing `preinstall`, `postinstall`, or `install` hooks in conjunction with known malicious package names like "@vpmdhaj" or "opensearch-setup". This allows defenders to identify attempts to install these specific malicious packages within their environments.
Another query focuses on command and control, searching DeviceNetworkEvents for connections to the C2 domain "aab.sportsontheweb.net" or the presence of the unique "X-Supply: 1" HTTP header, which indicates active beaconing by the threat actor. For defense evasion (T1218), we monitor DeviceNetworkEvents for `node.exe` processes connecting to "github.com/oven-sh/bun/releases", signaling the download of the Bun runtime for proxy execution. This helps identify the setup phase of the attack.
To detect credential access attempts, a KQL query on DeviceNetworkEvents identifies `node.exe`, `bun.exe`, or `payload.bin` processes attempting to connect to cloud metadata service IPs such as "169.254.169.254" or "169.254.170.2". This directly flags attempts to steal cloud credentials (T1552.009). Finally, we also look for the persistence mechanism by identifying processes or initiating processes with "__DAEMONIZED=1" in their command line, a specific indicator of the daemonized payload.
Defenders should implement these queries to monitor for suspicious npm and node execution, network connections to known C2 infrastructure, and attempts to access cloud metadata services from development or CI/CD environments. Regular review of process command lines and network traffic from build agents is crucial for detecting such supply chain attacks.