13 techniques observed across 2 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
Initial Access TA0001
T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools×1
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
T1059.007Command and Scripting Interpreter: JavaScript×1
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
T1552.001Unsecured Credentials: Credentials In Files×2
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
T1567.001Exfiltration Over Web Service: Exfiltration to Code Repository×1
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
Wiz Research's autonomous "Red Agent" AI red-teaming tool independently discovered and exploited a GitHub Actions script-injection vulnerability in Snowflake's public snowflake-connector-net repository, introduced via PR #1218 (18 June 2026) and undetected by GitHub Advanced Security despite the flaw sitting directly in the analysed workflow. The injectable pattern entered the jira_issue.yml workflow in commit 094038e and went live when PR #1218 was squash-merged as commit 4a1b8ce: "the injectable pattern was added to jira_issue.yml in commit 094038e and became live when PR #1218 was squash-merged as commit 4a1b8ce" (Wiz Research, 2026-08-17), allowing an unauthenticated actor to inject shell commands via a crafted GitHub issue title interpolated unsanitised into the workflow's shell step.
When the agent's initial payload (using # to comment out the rest of the line) hit an unexpected bash syntax error (the comment character also consumed the closing parenthesis of the shell's TITLE=$(...) construct) it did not stop or fail. Instead it "autonomously analyzed the syntax execution error" and "adjusted its payload to use ; echo ' to properly close the shell block, and" (Wiz Research, 2026-08-17) retried, recovering from its own exploitation error without human direction. Within seconds, Wiz's listener received an out-of-band callback from the GitHub Actions runner carrying base64-encoded Jira API credentials tied to a qa@snowflake.net account: "within seconds, our listener received the callback from a GitHub Actions runner containing base64-encoded credentials" (Wiz Research, 2026-08-17). Snowflake patched the workflow the same day of disclosure (23 June 2026, commit 1dc7766/PR #1402), restoring safe env: variable interpolation and jq --arg parsing.
This is a further, vendor-independent data point in the CI/CD trust-boundary thread already covered here around GitHub Actions script injection. The autonomous-error-recovery behaviour (diagnosing a failed exploitation attempt and adjusting the payload without human intervention) is itself a capability marker worth tracking regardless of which side deploys it: the same recovery loop that let Wiz's defensive tool self-correct mid-exploit is available to an offensive operator running comparable tooling against any organisation's own public CI/CD workflows. Triage: GitHub Actions workflows that interpolate untrusted issue or pull-request titles directly into shell steps, rather than passing them through env: variables with jq --arg-style safe parsing, are the systemic pattern this flaw exemplifies, an audit of any organisation's public-repository workflows for this exact interpolation shape is the actionable takeaway, independent of this specific incident.
The injectable pattern was added to jira_issue.yml in commit 094038e and became live when PR #1218 was squash-merged as commit 4a1b8ce.
autonomously analyzed the syntax execution error
adjusted its payload to use ; echo ' to properly close the shell block, and
Within seconds, our listener received the callback from a GitHub Actions runner containing base64-encoded credentials.
Snowflake patched the workflow on June 23, 2026 (1dc7766, PR #1402), fully restoring the safe env: variable and jq --arg parsing pattern.
Elastic Security Labs identified a new Shai-Hulud campaign on 2026-08-04 that began by trojanising the monorepo of keyv, a widely used key-value storage library, and embedding a self-propagating worm it names CHAINDROP (Elastic Security Labs, 2026-08-06). Elastic reports over 400 unique npm packages compromised at the time of writing, and quantifies the blast radius through download volume: keyv alone received over 600 million downloads in the preceding month, with flat-cache near 580 million, cacheable-request over 137 million, cacheable over 30 million and cache-manager over 16 million (Elastic Security Labs, 2026-08-06). OX Security published its own first-hand analysis two days earlier and describes a massive Shai-Hulud campaign against npm on its own larger package and download counts (OX Security, 2026-08-04). Elastic frames the wave explicitly as the return of Shai-Hulud rather than a new family, and points to the Dune-derived naming the payload reuses as the similarity to previous Shai-Hulud campaigns (Elastic Security Labs, 2026-08-06).
Execution. The chain starts at a preinstall hook in package.json, abusing a legitimate npm feature that runs arbitrary commands before a package is installed and therefore needs no interaction from the victim beyond the install itself (Elastic Security Labs, 2026-08-06). Every subpackage in the keyv repository was backdoored with a dropper that checks whether the Bun JavaScript runtime is present and, if not, detects the host platform and architecture and downloads Bun directly from its official release page before using it to execute the payload; the temporary Bun directory is deleted afterwards (Elastic Security Labs, 2026-08-06). The payload is cross-platform across Linux, macOS and Windows, and is heavily obfuscated at 711 kilobytes using control-flow flattening (Elastic Security Labs, 2026-08-06). It appears under two filenames (one in packages compromised directly from the keyv monorepo, another in packages trojanised during worm propagation) which share the same hash, so the filename indicates which generation of the infection a defender is looking at (Elastic Security Labs, 2026-08-06).
A second infection route that does not involve installing anything. In Visual Studio Code a folderOpen task under tasks.json runs the dropper when an infected repository is merely opened, and where the stolen credential set includes a GitHub App token the worm commits malicious hooks to up to 50 branches per accessible repository, injecting both a .claude/settings.json and a .vscode/tasks.json into each, so a developer can be infected by opening the repository (Elastic Security Labs, 2026-08-06). That is the operationally important departure: an organisation that responds to a supply-chain wave purely by pinning or freezing dependency installs has not closed the path that fires when an engineer clones and opens the repository, and the AI-assistant configuration file is a trust surface most repository review does not read.
Collection and exfiltration. A collector component scans over 300 unique patterns across credential stores on a developer machine, with notable targeting of AI-tooling credentials for Anthropic, Claude, Codex, Cursor, OpenAI and Gemini, alongside AWS, GCP, Azure and Alibaba Cloud credentials, GitHub personal-access tokens, JWTs and session tokens, HashiCorp Vault tokens, SSH private keys, Kubernetes service-account tokens and npm tokens (Elastic Security Labs, 2026-08-06). Harvested material is gzip-compressed, encrypted under a randomly generated AES-256-GCM key, and that key is in turn RSA-encrypted to the attacker's hardcoded public key (Elastic Security Labs, 2026-08-06). For delivery, CHAINDROP does not hardcode a command-and-control domain: it queries an Ethereum smart contract at runtime to retrieve the current exfiltration endpoint, using multiple RPC providers as fallbacks, so the operator can rotate infrastructure by updating the contract rather than by shipping a new payload (Elastic Security Labs, 2026-08-06). If that path and its successor fail, it falls back to exfiltrating through a public GitHub repository created under the victim's own account with a fixed Shai-Hulud description string (Elastic Security Labs, 2026-08-06).
A containment-sequencing warning the two reports do not agree on. OX Security states the malware carries a dead man's switch that deletes the current machine if the stolen GitHub token is revoked (OX Security, 2026-08-04). Elastic's own guidance is to revoke all GitHub tokens for impacted machines and does not mention any such trigger (Elastic Security Labs, 2026-08-06). Only one vendor reports it and the other does not corroborate it, so treat it as an unconfirmed claim from a first-hand analysis rather than an established property, but sequence around it, because the cost of being wrong is asymmetric. Isolating and imaging a suspected host before revoking its GitHub token loses nothing if the switch does not exist, while revoking first loses the host and its evidence if it does.
Propagation gate. The worm activates only when the credential sweep turns up an npm token meeting two conditions together: package-write permission, and the ability to publish without two-factor authentication (Elastic Security Labs, 2026-08-06). Given a qualifying token it enumerates every package the victim can publish to, downloads each latest tarball from the registry, and republishes it trojanised (Elastic Security Labs, 2026-08-06). That gate is the single most useful fact in the report for a defender, because it converts an unbounded ecosystem-wide risk into a property you can audit on your own accounts.
Triage: developer and CI hosts legitimately run script interpreters from package-manager parents on every build, and legitimately download toolchains, so neither alone discriminates. The separating features are that the runtime is fetched mid-install rather than during provisioning and its directory is removed immediately afterwards; that the process reads credential stores belonging to unrelated tools (cloud CLIs, SSH, Kubernetes, AI assistants) in one burst, which no ordinary build step does; and that outbound blockchain RPC follows the credential reads in the same process tree. Any one of these is weak on its own; the sequence is the signal.
keyv alone received over 600 million downloads last month
Execution is triggered via a preinstall hook in package.json.
package write permissions and the ability to publish without two-factor authentication (bypass_2fa)
CHAINDROP does not hardcode a C2 domain; instead, it queries an Ethereum smart contract
locates the Runner.Worker process on GitHub Actions runners, opens /proc/<pid>/maps and /proc/<pid>/mem, and searches live process memory for OpenID Connect (OIDC) tokens and runner secrets.
This is not forged provenance. The attestation says the tarball was built in that repository by that workflow, and that is true.
Pivot on the Rekor log index and the workflow identity inside the certificate, not on whether the signature checks out.
Unit 42 published its own analysis of the CHAINDROP wave on 2026-08-06, and two of its findings change what defenders can rely on rather than adding detail to what they already knew.
The first is credential theft that never touches disk. An embedded Python helper hidden inside an encrypted blob in the payload "locates the Runner.Worker process on GitHub Actions runners, opens /proc/<pid>/maps and /proc/<pid>/mem, and searches live process memory for OpenID Connect (OIDC) tokens and runner secrets" (Unit 42, 2026-08-06). Ephemeral OIDC tokens exist to avoid long-lived secrets sitting in a file or a variable; reading them out of the runner's address space while they are live defeats that design, and any secret-scanning control that inspects files or environment variables at rest sees nothing.
The second is a single-target path that is worse than a forgery. The worm checks three environment variables and only proceeds if it finds itself inside GitHub Actions, in a repository whose name contains /opensearch-js, in a workflow whose reference contains release-drafter.yml; anywhere else in that project it exits and steals nothing, staying silent in exactly the runs a maintainer is most likely to be reading (Unit 42, 2026-08-06). In that path it asks the runner for an OIDC token scoped to npm:registry.npmjs.org and trades it at npm's own trusted-publishing exchange for a real publish credential, the repository's legitimate release identity becomes the attacker's. It then downloads the latest tarball, bumps the patch version and adds a single dependency line typosquatting the project's own scope, never touching install scripts at all, so detections built around preinstall hooks would miss it. Finally it requests a second OIDC token for Sigstore, obtains a Fulcio certificate, builds an in-toto SLSA v1 provenance statement over the tarball's SHA-512 hash, signs it and uploads the entry to the public Rekor transparency log (Unit 42, 2026-08-06).
Unit 42 is explicit about what that means: "This is not forged provenance. The attestation says the tarball was built in that repository by that workflow, and that is true." Its guidance follows directly; a package having valid npm provenance does not mean the package is clean, only that the tarball came out of the workflow named in the certificate, and if that workflow is running attacker code then valid provenance is what you should expect to see. "Pivot on the Rekor log index and the workflow identity inside the certificate, not on whether the signature checks out" (Unit 42, 2026-08-06).
Unit 42 states it did not observe this path execute and that it cannot execute anywhere except in that one workflow in that one repository, but that it is fully implemented and reachable from the payload's main entry point (Unit 42, 2026-08-06). The worm also runs a locale gate before any collection, exiting cleanly on a Russian-language host.