(datadoghq.com) Analysis of the Shai-Hulud Offensive Framework: TeamPCP's Modular TypeScript Toolkit for Supply Chain and Credential Harvesting Attacks

[orlysec@swecyb.com]

(datadoghq.com) Analysis of the Shai-Hulud Offensive Framework: TeamPCP's Modular TypeScript Toolkit for Supply Chain and Credential Harvesting Attacks

TeamPCP's Shai-Hulud framework, a modular TypeScript/Bun toolkit, was exposed—revealing advanced supply chain and credential harvesting TTPs targeting CI/CD pipelines and dev environments.

In brief - TeamPCP’s Shai-Hulud framework leverages GitHub Actions exploitation, OIDC token abuse, and sigstore provenance forgery to poison npm packages and harvest credentials. Features include memory extraction from CI runners, hybrid encryption for exfiltration, and a coercive deadman switch for persistence. The framework avoids CIS countries, aligning with TeamPCP’s known targeting patterns.

Technically - Shai-Hulud is a production-grade offensive framework written in TypeScript for the Bun runtime. It employs:
- **Credential Harvesting**: Memory extraction from GitHub Actions runners (bypassing secret masking), environment variable scraping, and scanning of 100+ sensitive file paths.
- **Exfiltration**: Hybrid encryption (AES-256-GCM + RSA-4096-OAEP) for C2 or GitHub dead-drop exfiltration.
- **Persistence**: macOS LaunchAgents, Linux systemd services, and a deadman switch threatening data destruction.
- **Supply Chain Poisoning**: OIDC-based trusted publishing and sigstore provenance forgery to legitimize malicious npm packages.
- **Obfuscation**: Polyalphabetic substitution and control flow flattening to evade signature-based detection. Russian locale check confirms TeamPCP’s operational scope.

Source: https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/

#Cybersecurity #ThreatIntel