Shai-Hulud npm Stealer Uses Ethereum Contract to Resolve C2
Summary
Netskope analyzed 28 malicious npm package versions across four namespaces. Their stealer downloads Bun, harvests developer and CI/CD credentials, and resolves its exfiltration host through an Ethereum smart contract.
Key points
- The packages were published on August 4, 2026, in two rapid bursts across @or-sdk, @onereach, @servicetitan, and @umacloud.
- Their install hook downloads a signed Bun runtime from GitHub, runs an obfuscated JavaScript stealer, then deletes the runtime.
- The payload collects SSH keys, AWS and Docker credentials, Jenkins secrets, GitHub CLI tokens, and other sensitive data.
- It enumerates AWS Systems Manager Parameter Store and Secrets Manager across 17 regions, queries EC2 instance metadata, and attempts Vault AWS login.
- An Ethereum smart contract queried through public RPC providers supplies the exfiltration domain at runtime, allowing the operator to change infrastructure without republishing packages.
- The payload posts an encrypted bundle to npm-cache.com/router; its hash matches a sample from the same-day keyv package-family compromise.
- Netskope says the publishing vector is undetermined; the report recommends behavior-based detection because the packages contain no malicious binary and use a legitimate signed runtime.
Article Details
- Attack Vectors
- Malicious npm package versions published across four unrelated enterprise namespaces ran a preinstall dropper that downloaded a Bun runtime, executed an obfuscated JavaScript stealer, and deleted the runtime.
- The stealer resolved its exfiltration endpoint at runtime by calling an Ethereum smart contract through public Ethereum RPC providers.
- The payload collected developer and CI/CD credentials and secrets, including SSH keys, AWS credentials, Docker registry authentication, Jenkins secrets, and /etc/shadow, and attempted to access AWS and Vault resources.
- Defensive Notes
- Detection should focus on behavior because the packages contain no malicious executable and download a legitimately signed runtime.
- Monitor for the package install behavior, secret and credential collection, Ethereum eth_call-based endpoint resolution, and outbound POST activity.
- The article advises using the public Ethereum RPC endpoint indicators for detection and alerting, not blind blocking.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | npm-cache[.]com | Exfiltration endpoint; the payload posts the encrypted bundle to /router. |
| SHA256 | 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc | SHA256 of the stealer payload math_init.js, reported as identical to the keyv-family sample. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe stealer sends an encrypted bundle of collected data to npm-cache.com/router.T1059.007 · JavaScriptThe install chain executes an obfuscated JavaScript stealer under the downloaded Bun runtime.T1195.002 · Compromise Software Supply ChainMalicious npm package versions were published to deliver the stealer through package installation.T1526 · Cloud Service DiscoveryThe payload enumerates AWS Systems Manager Parameter Store and Secrets Manager across 17 regions.T1552.001 · Credentials In FilesThe payload searches for SSH private keys and credentials in developer and CI/CD locations.