--- analysis: A simple detection rule for 'npm install' or 'preinstall' is too noisy for developer environments. This hunt stacks child processes across the fleet to find rare hooks and correlates that rarity with credential file access, providing the context an analyst needs to judge a supply chain compromise. blind_spots: - id: missing-memory-telemetry question: Was a script reading the memory of the GitHub runner process directly? requires: Process memory access telemetry (CrossProcessHandle) risk: Harvesters like ChainDrop can read OIDC tokens directly from memory without touching sensitive configuration files on disk, bypassing file-based detection. stage: cicd-secret-memory-scraping - id: ephemeral-runner-logs question: Did the telemetry reach the platform before the ephemeral build host was destroyed? requires: Centralized, real-time telemetry forwarding for ephemeral CI/CD runners risk: Short-lived CI/CD runners may execute a hook and be terminated before the agent can flush its event buffer, leading to missed execution signals. stage: malicious-npm-hook-execution coverage: - stage: malicious-npm-hook-execution status: covered steps: - rare-build-child-processes - stage: payload-delivery-bun-runtime status: covered steps: - rare-build-child-processes - triage-sdlc-exposure - blind_spot: missing-memory-telemetry reason: Memory-based scraping is not visible on standard process or file surfaces; partially addressed by monitoring sensitive file access instead. stage: cicd-secret-memory-scraping status: not_visible - reason: 'Belongs to another part of the ''Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain'' series.' stage: developer-tool-backdooring status: out_of_scope - reason: 'Belongs to another part of the ''Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain'' series.' stage: blockchain-based-c2 status: out_of_scope - reason: 'Belongs to another part of the ''Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain'' series.' stage: automated-worm-propagation status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Build-time supply chain attacks bypass production SBOMs and runtime security. A negative result verifies that authorized developer systems are not executing rare, unauthorized setup hooks that harvest secrets. methodology: model-assisted trigger: intel-report hypothesis: An attacker has compromised a software dependency to execute malicious code during the build phase, subsequently harvesting cloud and developer credentials from the environment's configuration files. labels: - hunt - attack.t1195.002 - attack.t1059.003 - attack.t1105 - attack.t1059.007 - attack.t1003 - attack.t1528 - attack.t1552.004 name: Build-Time Execution and Secret Harvesting parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-08-21' ref: standard-retention type: number scope_hosts: default: [] description: Optional list of hostnames to focus on (e.g. known CI/CD runners); leave empty for the whole estate. from: kind: manual observed: '2026-08-21' ref: analyst-scoping type: list[host] sensitive_paths: default: - /home/runner/.npmrc - /root/.npmrc - /home/runner/.aws/credentials - /root/.aws/credentials - /home/runner/.ssh/id_rsa - /root/.ssh/id_rsa - tasks.json - .git-credentials description: Specific credential and configuration file paths commonly targeted by harvesters. from: kind: article observed: '2026-08-21' ref: unit42-sdlc type: list[path] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/sdlc-supply-chain/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt scopes using software inventory to find hosts where development tools are installed. Focus the lookback on recent dependency updates or pipeline runs. references: - name: "Unit 42 \u2014 Connecting the Dots: Securing the Overlooked Corners of the\ \ SDLC Supply Chain" url: https://unit42.paloaltonetworks.com/sdlc-supply-chain/ related: - hunt: developer-tool-configuration-tampering reason: This hunt focuses on build-time execution and harvesting; persistence via backdooring VS Code or Claude Code configurations belongs to a separate investigation. relation: out-of-scope-alternative scenario: stages: - name: Malicious npm preinstall hook execution observables: - npm install - preinstall scripts in package.json - npm hooks slug: malicious-npm-hook-execution tactic: execution techniques: - T1195.002 - T1059.003 - name: Payload delivery via Bun runtime observables: - Bun runtime download - 727 KB obfuscated payload - Background payload launch slug: payload-delivery-bun-runtime tactic: execution techniques: - T1105 - T1059.007 - name: CI/CD and endpoint secret harvesting observables: - Python script reading live process memory - GitHub Actions runner memory scraping - OpenID Connect (OIDC) tokens - Local developer credentials sweep slug: cicd-secret-memory-scraping tactic: credential-access techniques: - T1003 - T1528 - T1552.004 - name: Persistence via developer tool configuration observables: - VS Code tasks.json modification - Claude Code cross-linked hooks slug: developer-tool-backdooring tactic: persistence techniques: - T1546 - name: Blockchain command and control observables: - Ethereum blockchain transactions - Dynamic C2 infrastructure slug: blockchain-based-c2 tactic: command-and-control techniques: - T1102 - name: Automated package propagation observables: - Stolen npm tokens - Stolen GitHub tokens - Republishing infected packages (keyv, cacheable-request) - Creation of rogue repositories slug: automated-worm-propagation tactic: lateral-movement techniques: - T1534 - T1195.002 summary: Attackers target the software supply chain by poisoning package dependencies with malicious preinstall hooks that execute during development and build processes. The ChainDrop worm specifically scrapes CI/CD runner memory for OIDC tokens and local credentials to establish persistence in developer tools like VS Code and automatically propagate by infecting and republishing additional packages. series: index: 1 slug: connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-s title: 'Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Build-Time Execution and Secret Harvesting Attackers are increasingly targeting the software build process rather than the application code. This hunt identifies the initial execution of malicious lifecycle hooks (like npm preinstall), the delivery of unauthorized runtimes like Bun, and the subsequent harvesting of sensitive credentials. By scoping to development environments and stacking rare child processes spawned by package managers, we identify anomalous behaviors that static bill-of-materials scans miss. ## find-sdlc-environments Scope the hunt to systems where package managers or runtimes are present, representing the SDLC attack surface. ```sqlite target=endpoint role=scoping params=(scope_hosts=scope_hosts) ~~~yaml expected: A list of hostnames with development tools. Silence indicates no such software is inventoried, making the hunt non-applicable. reads: - device_hostname - package_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%npm%' OR LOWER(package_name) LIKE '%node%' OR LOWER(package_name) LIKE '%bun%' OR LOWER(package_name) LIKE '%python%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) ``` ## rare-build-child-processes Identify anomalous processes spawned by package managers, which can reveal malicious lifecycle hooks or secondary payloads. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Command lines involving 'preinstall' scripts or rare secondary runtimes seen on very few hosts. Silence suggests no unusual hook execution occurred. prevalence: by: device_hostname key: - process_cmd_line rare_below: 3 reads: - process_cmd_line - device_hostname - parent_process_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%npm%' OR LOWER(parent_process_name) LIKE '%node%' OR LOWER(parent_process_name) LIKE '%bun%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING hosts <= 3 ORDER BY hosts ASC ``` ## secret-file-access Find file activity targeting sensitive paths by developer tools or their child processes. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, sensitive_paths=sensitive_paths) ~~~yaml expected: Access to .npmrc, .aws/credentials, or tasks.json by non-standard processes. Silence means no direct file-level harvesting was observed. reads: - device_hostname - process_name - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, file_path, time FROM hb_file_activity WHERE instr(',' || '{{sensitive_paths}}' || ',', ',' || LOWER(file_path) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-sdlc-exposure ```agent target=hunter cite: required context: - find-sdlc-environments - rare-build-child-processes - secret-file-access max_iterations: 4 objective: Determine if the rare child processes spawned by npm, node, or bun indicate a malicious build-time execution event and whether those processes accessed sensitive credentials. success_criteria: A per-host verdict of malicious | suspicious | benign citing rows and linking process rarity to credential access. tools: - endpoint ``` ## route-exposure if~: "The triage verdict identifies malicious lifecycle hooks or unauthorized secret harvesting on any developer host." (confidence: high, judge=hunter) then: → remediation-review indeterminate: → remediation-review unavailable: → remediation-review (blind_spot: missing-memory-telemetry) else: → close-out ## remediation-review ```manual target=analyst For any host with suspicious activity, rotate all local developer credentials (SSH, AWS, npm) and OIDC tokens. Review the package.json of the affected project to identify the malicious dependency. Consider implementing --ignore-scripts policy. ``` → close-out ## close-out ```manual target=analyst Record the baseline of common preinstall hooks used in your business to reduce noise for future hunts. Document any coverage gaps found during the process. ``` → end