![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-171.webp\")
Figure 1. vpmdhaj npm supply chain attack flow.<\/p>\n\t\tIn this article<\/p>\n
Microsoft has identified an active supply chain attack targeting the npm package ecosystem. On May 28, 2026, a single threat actor operating under the newly created maintainer alias vpmdhaj (a39155771@gmail[.]com) published 14 malicious packages within a four-hour window. The packages typosquat well-known OpenSearch, ElasticSearch, DevOps, and environment-configuration libraries, and several spoof the upstream OpenSearch project\u2019s repository URL in their package.json to appear legitimate. Once installed, the packages harvest AWS credentials, HashiCorp Vault tokens, and CI\/CD pipeline secrets from the host environment.<\/p>\n
All packages in the cluster ship the same install-time stager and the same Bun-compiled second-stage payload \u2013 a ~195 KB credential harvester purpose-built for cloud and CI\/CD environments. The payload runs silently during npm install and targets credentials across Amazon Web Services, HashiCorp Vault, GitHub Actions, and the npm registry itself, enabling both cloud lateral movement and downstream supply-chain pivoting through stolen npm publish tokens. Based on our investigation and feedback to the npm team these repos and users were taken down.<\/p>\n
Key capabilities observed in the campaign include automatic execution via npm lifecycle hooks, two distinct stager generations (an HTTP-C2 variant and a stealthier variant that abuses the legitimate Bun runtime distribution), AWS Instance Metadata Service (IMDSv2) and ECS task-role theft, AWS Secrets Manager enumeration across 16+ regions, HashiCorp Vault token harvesting, and theft of npm publish tokens for follow-on supply-chain attacks.<\/p>\n
Attack chain overview<\/p>\n
The vpmdhaj cluster spans 14 scoped and unscoped packages that all mimic the @opensearch \/ @elastic ecosystem. The attack proceeds through:<\/p>\n
Publication of 14 typosquat packages under a single actor identity<\/p>\n
Automatic payload execution through a preinstall hook during npm install<\/p>\n
Execution chain (Gen-1): node -> preinstall.js -> HTTP C2 -> payload.bin (detached)<\/p>\n
Execution chain (Gen-2): node -> setup.mjs -> download legitimate Bun runtime -> run bundled stage-2<\/p>\n
Cloud credential theft (AWS IMDS, ECS metadata, Vault, Secrets Manager) and npm publish-token theft for downstream supply-chain pivot<\/p>\n
Figure 1. vpmdhaj npm supply chain attack flow.<\/p>\n
The lure: typosquats and spoofed metadata<\/p>\n
The actor adopted three social-engineering techniques designed to drive installs by mistake or trust transference. First, lookalike naming \u2013 names such as opensearch-setup, opensearch-setup-tool, opensearch-config-utility, elastic-opensearch-helper, search-engine-setup, and env-config-manager mimic well-known cluster-management and configuration libraries. Second, spoofed upstream metadata \u2013 every unscoped package sets its package.json homepage, repository, and bugs fields to the legitimate github.com\/opensearch-project\/opensearch-js project. Third, inflated version numbers \u2013 releases jump straight to 1.0.7265, 1.0.9108, or 2.1.9201 to suggest a long, mature release history.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-172.webp\")
Figure 2. npm.js package page for @vpmdhaj\/elastic-helper showing the inflated 1.0.7269 version and the spoofed OpenSearch repository link.<\/p>\n
Execution: npm lifecycle hook abuse<\/p>\n
Every package in the cluster declares an automatic install-time hook in package.json. The malicious code executes the moment a victim runs npm install \u2013 no require() from victim code is needed. Two stager variants were observed:<\/p>\n
Gen-1 (versions <= 1.0.7265): install, preinstall, and postinstall hooks all invoke preinstall.js \/ index.js<\/p>\n
Gen-2 (versions >= 1.0.7266): a single preinstall hook invokes setup.mjs (newer, stealthier loader)<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-173.webp\")
Figure 3. The malicious package.json. A single preinstall hook is enough to gain code execution on every npm install.<\/p>\n
Gen-1 stager: HTTP C2 beacon and payload drop<\/p>\n
preinstall.js collects rich host context \u2013 hostname, platform, arch, Node version, USER\/USERNAME, cwd, INIT_CWD, npm_package_name, npm_package_version \u2013 base64-encodes the JSON, and POSTs it to the actor\u2019s C2 with a campaign-unique header X-Supply: 1. The same C2 endpoint then serves a gunzip-compressed second-stage binary, which is written to payload.bin in the package install directory, chmod 0755\u2019d, and spawned detached.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-174.webp\")
Figure 4. Stage-1 C2 beacon. The X-Supply: 1 header is a high-confidence detection signal in proxy logs.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-175.webp\")
Figure 5. Stage-2 download, decompression, +x, and detached spawn. __DAEMONIZED=1 lets the payload distinguish itself from npm.<\/p>\n
The package\u2019s index.js re-launches the same payload.bin on every subsequent require() of the module \u2013 a quiet persistence mechanism that survives across CI build stages and developer rebuild loops. The module also exports a benign-looking object falsely identifying itself as @opensearch\/setup.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-176.webp\")
Figure 6. Persistence shim. The malicious module exports benign-looking metadata and silently re-spawns the payload every time it is require()\u2019d.<\/p>\n
Gen-2 stager: abusing the legitimate Bun runtime as a loader<\/p>\n
In newer versions, the actor replaced the noisy HTTP-C2 design with a stealthier loader that eliminates the install-time C2 round-trip entirely. setup.mjs (a) checks whether bun is already present on the host; (b) if not, downloads the legitimate Bun runtime v1.3.13 from github.com\/oven-sh\/bun\/releases for the correct platform\/arch (Linux x64\/musl\/aarch64, macOS x64\/arm64, Windows x64\/arm64); (c) extracts the ZIP using unzip, PowerShell Expand-Archive, or a hand-rolled ZIP parser; and (d) executes the pre-bundled second-stage payload (opensearch_init.js or ai_init.js) that ships inside the npm tarball.<\/p>\n
This design reduces visibility for defenders that primarily monitor unusual outbound traffic during package installation.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-177.webp\")
Figure 7. Gen-2 loader. The actor abuses a legitimate GitHub Release of the Bun runtime to execute a pre-bundled payload that ships inside the npm tarball.<\/p>\n
Credential theft<\/p>\n
The second-stage binary is a single-file Bun-compiled JavaScript binary of approximately 195 KB, purpose-built for cloud and CI\/CD secret theft. Static review of the bundle identifies routines that target secrets across five platforms:<\/p>\n
AWS: queries EC2 Instance Metadata Service v2 (169.254.169[.]254), Elastic Container Service task metadata (169.254.170[.]2), reads AWS env credentials, calls STS GetCallerIdentity \/ AssumeRole, and enumerates Secrets Manager (ListSecrets \/ GetSecretValue) across 16+ regions with a bundled SigV4 signer.<\/p>\n
HashiCorp Vault: reads VAULT_TOKEN and VAULT_AUTH_TOKEN environment variables.<\/p>\n
npm: validates tokens through \/-\/whoami and enumerates publish access through \/-\/npm\/v1\/tokens.<\/p>\n
GitHub Actions: collects GITHUB_REPOSITORY and RUNNER_OS context to identify build environments for prioritized exploitation.<\/p>\n
CI\/CD environment: respects __DAEMONIZED=1 to avoid re-entry, and explicitly resets CI=false to mislead build-aware code paths.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-178.webp\")
Figure 8. String evidence from the Bun-compiled stage-2 payload. The same binary is dropped by both Gen-1 and Gen-2 stagers.<\/p>\n
Impact and blast radius<\/p>\n
Stolen AWS STS sessions and Secrets Manager material enable cloud lateral movement and data theft.<\/p>\n
Stolen GitHub Actions tokens enable repo manipulation and CI\/CD pipeline tampering.<\/p>\n
Stolen npm publish tokens enable downstream supply-chain pivoting \u2013 pushing malicious updates to packages owned by hijacked maintainer identities, expanding the campaign beyond the initial 14 packages.<\/p>\n
All 14 packages target the OpenSearch \/ ElasticSearch ecosystem keywords, suggesting the actor likely chose a developer audience to have AWS and Elastic cloud credentials in their environments.<\/p>\n
Mitigation and protection guidance<\/p>\n
Microsoft recommends the following mitigations to reduce the impact of this threat:<\/p>\n
Identify systems that installed or built affected package versions on or after May 28, 2026.<\/p>\n
Pin known-good package versions where possible and avoid automatic dependency upgrades until validation is complete.<\/p>\n
Disable pre- and post-installation script execution by running npm install with \u2013ignore-scripts (or setting npm config set ignore-scripts true globally). Apply equivalent settings for pnpm and yarn.<\/p>\n
Rotate AWS IAM\/STS, HashiCorp Vault, npm publish, and GitHub Actions tokens that may have been exposed to affected runners or developer workstations.<\/p>\n
Block egress to aab.sportsontheweb[.]net at proxy, firewall, and DNS layers. Alert on any HTTP request carrying the header X-Supply: 1.<\/p>\n
Hunt CloudTrail for anomalous sts:GetCallerIdentity rapidly followed by sts:AssumeRole, and for secretsmanager:ListSecrets or GetSecretValue in cross-region succession from build infrastructure or developer IP space.<\/p>\n
Audit CI\/CD logs for unexpected outbound network connections, Bun runtime downloads from GitHub Releases by Node.js processes, and detached child processes spawned with __DAEMONIZED=1.<\/p>\n
Review npm package lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml), build logs, and artifact provenance for evidence of compromised package versions.<\/p>\n
Enable cloud-delivered protection in Microsoft Defender Antivirus or equivalent antivirus protection.<\/p>\n
Use Microsoft Defender XDR to investigate suspicious activity across endpoints, identities, cloud apps, and developer environments.<\/p>\n
Use Microsoft Defender Vulnerability Management to search for the affected packages across your estate.<\/p>\n
How Microsoft Defender helps<\/p>\n
Microsoft Defender Antivirus detects and blocks the malicious components on access. During reproduction in our analysis environment, setup.mjs was automatically quarantined the moment the tarball was extracted to disk.<\/p>\n
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/image-179.webp\")
Figure 9. Microsoft Defender auto-quarantine of setup.mjs at extract time.<\/p>\n
Microsoft Defender XDR Detections<\/p>\n
Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.<\/p>\n
TacticObserved activityMicrosoft Defender coverageInitial Access \/ ExecutionSuspicious script execution during npm install or package lifecycle activityMicrosoft Defender Antivirus
\u00a0 -Trojan:JS\/ShaiWorm
\u00a0 -Trojan:JS\/ObfusNpmJs
\u00a0 -Backdoor:JS\/SupplyChain<\/p>\n
Microsoft Defender for Endpoint
\u00a0 \u2013 Suspicious usage of Bun runtime
\u00a0 \u2013 Suspicious installation of Bun runtime
\u00a0 \u2013 Suspicious Node.js process behavior<\/p>\n
Microsoft Defender XDR
\u00a0 \u2013 Suspicious file creation in temporary directory by node.exe
\u00a0 \u2013 Suspicious Bun execution from Node.js process<\/p>\n
Credential AccessPotential harvesting of AWS, Vault, GitHub Actions, and npm tokens from CI\/CD runnersMicrosoft Defender for Endpoint
\u00a0 \u2013 Credential access attempt
\u00a0 \u2013 Suspicious cloud credential access by npm-cached binary
\u00a0 \u2013 AWS Instance Metadata Service access from suspicious process<\/p>\n
Microsoft Defender for Cloud
\u00a0 \u2013 Possible IMDS abuse from container workload
\u00a0 \u2013 Anomalous Secrets Manager enumeration across regions<\/p>\n
Command and ControlOutbound HTTP beacon with X-Supply: 1 header to attacker-controlled C2Microsoft Defender for Endpoint
\u00a0 \u2013 Connection to a custom network indicator (aab.sportsontheweb[.]net)
\u00a0 \u2013 Suspicious outbound HTTP from npm install contextPersistenceRe-spawn of payload.bin on every require() of compromised packageMicrosoft Defender for Endpoint
\u00a0 \u2013 Detached child process spawned by node.exe with __DAEMONIZED=1<\/p>\n
Advanced hunting<\/p>\n
The following sample queries let you search for a week\u2019s worth of events. To explore up to 30 days of raw data, go to the Advanced Hunting page > Query tab, and update the time range to Last 30 days.<\/p>\n
Hunt for suspicious npm lifecycle script execution involving vpmdhaj packages.<\/p>\n
DeviceProcessEvents
\n| where Timestamp > ago(7d)
\n| where FileName in~ (“node.exe”, “node”, “npm.cmd”, “npm.exe”, “npx.cmd”, “npx.exe”)
\n| where ProcessCommandLine has_any (“preinstall”, “postinstall”, “install”)
\n| where ProcessCommandLine has_any (
\n “@vpmdhaj”, “opensearch-setup”, “opensearch-setup-tool”,
\n “opensearch-config-utility”, “opensearch-security-scanner”,
\n “search-engine-setup”, “search-cluster-setup”,
\n “elastic-opensearch-helper”, “vpmdhaj-opensearch-setup”,
\n “env-config-manager”, “app-config-utility”)
\n| project Timestamp, DeviceName, FileName, ProcessCommandLine,
\n InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName<\/p>\n
Hunt for the stage-2 payload artifact on disk.<\/p>\n
DeviceFileEvents
\n| where Timestamp > ago(7d)
\n| where FileName =~ “payload.bin”
\n| where FolderPath has “node_modules”
\n| project Timestamp, DeviceName, FolderPath, FileName,
\n InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName<\/p>\n
Hunt for detached payload execution with the campaign environment marker.<\/p>\n
DeviceProcessEvents
\n| where Timestamp > ago(7d)
\n| where ProcessCommandLine has “__DAEMONIZED=1”
\n or InitiatingProcessCommandLine has “__DAEMONIZED=1”
\n| project Timestamp, DeviceName, FileName, ProcessCommandLine,
\n InitiatingProcessFileName, InitiatingProcessCommandLine<\/p>\n
Hunt for Gen-2 loader: Bun runtime download from GitHub Releases by Node.js.<\/p>\n
DeviceNetworkEvents
\n| where Timestamp > ago(7d)
\n| where InitiatingProcessFileName in~ (“node.exe”, “node”)
\n| where RemoteUrl has “github.com\/oven-sh\/bun\/releases\/download”
\n| project Timestamp, DeviceName, RemoteUrl, RemoteIP,
\n InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName<\/p>\n
Hunt for C2 beacon to attacker infrastructure.<\/p>\n
DeviceNetworkEvents
\n| where Timestamp > ago(30d)
\n| where RemoteUrl has “aab.sportsontheweb.net”
\n or RemoteUrl has “sportsontheweb.net”
\n| project Timestamp, DeviceName, RemoteUrl, RemoteIP,
\n InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName<\/p>\n
Hunt for AWS IMDS \/ ECS metadata access from Node.js processes.<\/p>\n
DeviceNetworkEvents
\n| where Timestamp > ago(7d)
\n| where InitiatingProcessFileName in~ (“node.exe”, “node”, “bun.exe”, “bun”)
\n| where RemoteIP in (“169.254.169.254”, “169.254.170.2”)
\n| project Timestamp, DeviceName, RemoteIP, RemoteUrl,
\n InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName<\/p>\n
Indicators of Compromise (IOC)<\/p>\n
Affected npm packages \u2013 all published by maintainer vpmdhaj on 2026-05-28:<\/p>\n
IndicatorTypeDescription@vpmdhaj\/elastic-helper (1.0.7269)PackageTyposquat \u2013 ElasticSearch\/OpenSearch helper@vpmdhaj\/devops-tools (1.0.7267)PackageTyposquat \u2013 DevOps tools \/ OpenSearch setup@vpmdhaj\/opensearch-setup (1.0.7267)PackageTyposquat \u2013 OpenSearch setup utility@vpmdhaj\/search-setup (1.0.7268)PackageTyposquat \u2013 search engine setupopensearch-security-scanner (1.0.10)PackageUnscoped lookalike \u2013 security scanneropensearch-setup (1.0.9103)PackageUnscoped lookalike \u2013 spoofs opensearch-project repo URLopensearch-setup-tool (1.0.9108)PackageUnscoped lookalike \u2013 spoofs opensearch-project repo URLopensearch-config-utility (1.0.9106)PackageUnscoped lookalike \u2013 spoofs opensearch-project repo URLsearch-engine-setup (1.0.9108)PackageUnscoped lookalike \u2013 spoofs opensearch-project repo URLsearch-cluster-setup (1.0.9104)PackageUnscoped lookalike \u2013 spoofs opensearch-project repo URLelastic-opensearch-helper (1.0.9108)PackageUnscoped lookalike \u2013 spoofs opensearch-project repo URLvpmdhaj-opensearch-setup (1.0.9102)PackageUnscoped \u2013 author-named OpenSearch setupenv-config-manager (2.1.9201)PackageTyposquat \u2013 dotenv-style config managerapp-config-utility (1.0.9300)PackageTyposquat \u2013 generic app config utility<\/p>\n
Actor, network, and file IOCs<\/p>\n
IndicatorTypeDescriptionvpmdhajnpm maintainer aliasThreat actor publishing all 14 packagesa39155771@gmail.comEmailMaintainer contact email registered on npmaab.sportsontheweb[.]netDomainStage-1 C2 (Gen-1 packages)hxxp:\/\/aab.sportsontheweb[.]net\/x.phpURLBeacon + stage-2 payload endpoint (port 80)X-Supply: 1HTTP headerCampaign-unique marker \u2013 high-confidence proxy detection169.254.169.254IPAWS EC2 IMDSv2 endpoint queried by stage-2169.254.170.2IPAWS ECS task metadata endpoint queried by stage-2638788AFC4F1B5860A328312CAF5895ABD5F5632D28A4F2A85B09076E270D15DSHA-256preinstall.js (Gen-1 stager)77D92EFE7AF3547F71FD41D4A884872D66B1BE9499EAA637E91EAC866911694DSHA-256setup.mjs (Gen-2 stager)BFA149694EC6411C23936311A999163ADE54D6F38E2F4B0E3CFB8CB67BD7CFAASHA-256payload.gz (gzipped Bun stage-2)opensearch_init.jsFilenameBun-compiled stage-2 credential harvester (~195 KB)ai_init.jsFilenameAlternate stage-2 filename used by some Gen-2 packagespayload.binFilenameDropped stage-2 binary in node_modules install dir__DAEMONIZED=1Env varMarker set by stager when spawning detached payload<\/p>\n
References<\/p>\n
https:\/\/www.npmjs.com\/~vpmdhaj\u00a0 \u2013\u00a0 npm maintainer profile (all 14 packages)<\/p>\n
https:\/\/www.npmjs.com\/package\/@vpmdhaj\/elastic-helper<\/p>\n
https:\/\/www.npmjs.com\/package\/@vpmdhaj\/devops-tools<\/p>\n
https:\/\/docs.npmjs.com\/cli\/v10\/using-npm\/scripts\u00a0 \u2013\u00a0 npm lifecycle scripts documentation<\/p>\n
https:\/\/bun.sh\u00a0 \u2013\u00a0 Bun runtime (abused by Gen-2 stager as a loader)<\/p>\n
https:\/\/docs.aws.amazon.com\/AWSEC2\/latest\/UserGuide\/configuring-IMDS-use-IMDSv2.html\u00a0 \u2013\u00a0 IMDSv2 hardening guidance<\/p>\n
This research is provided by Microsoft Defender Security Research with contributions from\u00a0members of Microsoft Threat Intelligence.<\/p>\n
Learn more<\/p>\n
For the latest security research from the Microsoft Threat Intelligence community, check out the\u00a0Microsoft Threat Intelligence Blog<\/a>.<\/p>\n To get notified about new publications and to join discussions on social media, follow us on\u00a0LinkedIn<\/a>,\u00a0X (formerly Twitter)<\/a>, and\u00a0Bluesky<\/a>.<\/p>\n