Netskope Threat Labs details malicious npm stealer using Bun and Ethereum C2

Netskope Threat Labs reports 28 malicious npm versions published on 2026-08-04 across four enterprise namespaces, using a single, shared stealer payload. The report details how the packages run under a signed Bun runtime and exfiltrate credentials and secrets, with a command-and-control endpoint resolved at install time via an Ethereum smart contract.

Research Overview

Netskope Threat Labs analyzed 28 malicious npm package versions published across four unrelated enterprise namespaces: @servicetitan, @or-sdk, @onereach, and @umacloud. The publication activity was recorded from npm registry metadata for 2026-08-04 UTC.

The vendor identifies the campaign operator as Shai-Hulud, referencing consistent naming seen in earlier Netskope reporting. The report states the payload chain was confirmed by detonation in a sandbox environment.

Key Findings

The 28 versions fall into two closely timed publishing bursts, followed by a later release. @or-sdk and @onereach landed at 10:39 UTC, @servicetitan landed at 10:41 UTC, and @umacloud/knowledge arrived at 13:18 UTC.

All versions use an identical or functionally equivalent malicious payload, with a hash match confirmed for @umacloud/[email protected]. The report links the payload to the keyv-family compromise through matching recovered stealer samples, while stating the four namespaces are additional to earlier reporting.

Technical Breakdown

At installation time, the packages fetch a Bun runtime release from GitHub, execute an obfuscated JavaScript stealer under Bun, and delete the runtime afterward. The report states the stealer payload does not include a binary component and does not hardcode a C2 address in the packaged files.

In Netskope’s recovered sample, exfiltration routing is resolved at runtime by calling an Ethereum smart contract using an eth_call. The report states that three public Ethereum RPC providers were tried in sequence until one responded, and it also describes a way to change exfiltration infrastructure by updating contract state rather than republishing packages.

Operational Impact

Netskope’s sandbox detonation against @or-sdk/[email protected] described a credential and secret sweep designed to capture data from both developer systems and CI/CD build targets. The reported targets include SSH private keys, AWS credentials, Docker registry authentication, Jenkins secrets, and /etc/shadow.

The same execution path requests a GitHub CLI token, enumerates AWS Systems Manager Parameter Store and Secrets Manager across 17 regions, and queries EC2 instance metadata via the instance metadata service. The report also describes attempts to authenticate to HashiCorp Vault using the AWS auth method against localhost and exfiltration of an encrypted 4.8 KB bundle to npm-cache.com/router.

The vendor states detection depends on behavioral signals because the tarball does not contain a malicious binary and the executed runtime is legitimately signed. The report’s indicators include the Ethereum contract call selector used for C2 resolution and the exfiltration endpoint used by the campaign.

Blog Signals brief is a fact-based summary of the vendor blog. It covers how a single npm stealer payload, deployed across multiple enterprise namespaces in bursts, runs under a signed Bun runtime and exfiltrates secrets with an install-time C2 resolution mechanism based on Ethereum contract state.

The original article was written by Decision Insights Editorial.