Indicators of Compromise - What We Know About the NPM Supply Chain Attack 


[IoC]							[Detection Name] 
24a8425476dcf8106ff86e5a5dbdfe56767c3f83		Worm.JS.SHULUD.YXFIQ
0be45aa0f8f92e63b74f888fce0e8ccb3a843033		Worm.JS.SHULUD.YXFIQ
411a826870d686ba2d880efb2fd3db484d151560		Worm.JS.SHULUD.YXFIQ
8b98ab71cc71c8768de27af80a3e0d1bc6c8d809		Worm.JS.SHULUD.YXFIQ
7f64e210a3e4f0a4d4353f5b0e24cc6ed5f25f13		Worm.JS.SHULUD.YXFIP
19b5dc3aea3d2e403f6e1bfb2aadf4873a87c4b9		Trojan.JS.CRYPTOHIJACK.SMYXFII
ea8069be02451e9f78caf626547d63ce37c9e004		Trojan.JS.CRYPTOHIJACK.SMYXFII
94870190e0a2cc34cfb5800f3a7434b45273395d		Trojan.JS.CRYPTOHIJACK.SMYXFII
911ec8f2f54043c129d5a4116e0cddb04e96f71d		Trojan.JS.CRYPTOHIJACK.SMYXFII
8901bdcff8a93cc32d65f6dd5dc3a64bb702c37a		Trojan.JS.CRYPTOHIJACK.SMYXFII
60cb12384a8defcb020d996f16500cb4ae60544c		Trojan.JS.CRYPTOHIJACK.SMYXFII
f04799faa6add499aad64c9e50ecd8922656812d		Trojan.JS.CRYPTOHIJACK.SMYXFII
1fa896bff4d0aea2bdd90e2ca8ec58160d6e9130		Trojan.JS.CRYPTOHIJACK.SMYXFII
af9729d777b9837891f742db750bf35a0961c77e		Trojan.JS.CRYPTOHIJACK.SMYXFII
3cf10775ef49ed218730c2cfe9ac865d7d9782af		Trojan.JS.CRYPTOHIJACK.SMYXFII
87ecf3a97a3d760d99b1c7f91334d0e38ccc3089		Trojan.JS.CRYPTOHIJACK.SMYXFII
f8b9d1fd523282a9b620568927fb26daaeca4383		Trojan.JS.CRYPTOHIJACK.YXFIQ
e03f836f966616503dc4588bd17f80f4edf709cb		Trojan.JS.CRYPTOHIJACK.YXFIQ
7abebf9c56d06083102f0a01b10ace155c9e8855		Trojan.JS.CRYPTOHIJACK.YXFIQ
1e7dbe865a3e0408a319ee4a8b091add28452524		Trojan.JS.CRYPTOHIJACK.YXFIQ
1af9b4373657582edb9e20eab34b152be2ec70b4		Trojan.JS.CRYPTOHIJACK.YXFIQ
067648958b75806072527df55d9d3f727e4d2533		Trojan.JS.CRYPTOHIJACK.YXFIQ
47b63bc786960fda917ea9f5ff0023a3c50e2ca3		Trojan.JS.CRYPTOHIJACK.YXFIQ
ebcf69dc3d77aab6a23c733bf8d3de835a4a819a		Trojan.JS.CRYPTOHIJACK.YXFII
7c01f6ed54dc5c8dd7f3d44fb2c5e7baed2b8e84		Trojan.JS.CRYPTOHIJACK.YXFII
41b328df338a31e5afb05e4e37b3e89b29394523		Trojan.JS.CRYPTOHIJACK.YXFIJ
d4117240a8122c9f5c463a4d5b8a4d34cd243147		Trojan.JS.CRYPTOHIJACK.YXFIJ
bd398b4c641cc656510398bd70e181d572a9bc7b		Trojan.JS.CRYPTOHIJACK.YXFIJ
b43a8985746997b08842d55d32e8050dd943349a		Trojan.JS.CRYPTOHIJACK.YXFIJ
b28a3ab62a108d8094d2d2a8fa9f60a6af9189e6		Trojan.JS.CRYPTOHIJACK.YXFIJ
b0c9ed032985beda979cb0becba7b4a47b1de30c		Trojan.JS.CRYPTOHIJACK.YXFIJ
5518bc3a1df75f8e480efb32fa78de15e775155d		Trojan.JS.CRYPTOHIJACK.YXFIJ
9d893b6e0b50221889fbd2136d77112208746483		Trojan.JS.CRYPTOHIJACK.YXFIJ
9c14e3b712695d02c886df3503ce9ceadf67b99e		Trojan.JS.CRYPTOHIJACK.YXFIJ
3bc38b1fb607e2e393f0586ad137bec99e8a22dc		Trojan.JS.CRYPTOHIJACK.YXFIJ
8ad058047c5f2875f53cc12236cd715ab40918bb		Trojan.JS.CRYPTOHIJACK.YXFIJ
7e091778fdc88f043f3a5ad02647ca0ecb106311		Trojan.JS.CRYPTOHIJACK.YXFIJ
4b2d21961eb5ae538ae00c85655b28156c5135e3		Trojan.JS.CRYPTOHIJACK.YXFIJ
7a1ca7d142305e2886b988c2f0b524f89f003940		Trojan.JS.CRYPTOHIJACK.YXFIJ
78b18ee8f16e3d06997189ebac933c1048c74687		Trojan.JS.CRYPTOHIJACK.YXFIJ
014228830250bf081fce9db0826b10305bf4a075		Trojan.JS.CRYPTOHIJACK.YXFIJ
81f533be5a9ec9bb167634e509ed907896d6ea16		Trojan.JS.CRYPTOHIJACK.YXFIJ
2252418758a34f8b2708d13d641b8eea3a76a91c		Trojan.JS.CRYPTOHIJACK.YXFII
f416d1e4c19a8293306968d35fe27aa2be0a5d80		Trojan.JS.CRYPTOHIJACK.YXFII
c6490428b140893c27274b9e3bb33d2ab48a478d		Trojan.JS.CRYPTOHIJACK.YXFII
e97440fa7b29d5e4986bc88d7b2d8cec6f251267		Trojan.JS.CRYPTOHIJACK.YXFII
c577059020b7ae370c67cf0a3170eff4d7f2b038		Trojan.JS.CRYPTOHIJACK.YXFII
499756844aa7249d94c3ca3fd3f5346b3bdcabfe		Trojan.JS.CRYPTOHIJACK.YXFII
6323eac15e6029f92d7f53f786909dec04acc22a		Trojan.JS.CRYPTOHIJACK.YXFII
ef25127522cd65bf943000f78f9dd9bcdd8217f0		Trojan.JS.CRYPTOHIJACK.YXFII
70957568e6802538949197cf17709f8f29757c86		Trojan.JS.CRYPTOHIJACK.YXFII

[URLs]
webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7	C&C Server
npmjs[.]help						Malicious URL