"elf-" Campaign Targeting npm Supply Chain Packages
Targeted Sectors
· Software development, technology
· Cloud services
Any organization using npm packages in their CI/CD pipelines
Targeted Countries
· Global
BLUF
A new wave of malicious npm packages, tracked as "elf-", was discovered and quickly reported, designed to steal sensitive system data and authentication credentials from developer environments.
Date of First Reported Activity
· December 2025 latest wave.
Date of Last Reported Activity Update
· December 15, 2025
APT Names
· Not publicly attributed to a specific APT
· There is speculation that this might be tied to North Korean actors but that has not been confirmed.
Associated Criminal Organization Names
· None identified at this time.
IOCs
Malicious npm Packages
Naming Pattern
Packages typically follow the schema elf-stats-[adjective]-[noun]-[number].
Specific Examples
· elf-stats-northbound-wishlist-684
· elf-stats-mulled-stockpile-411
· elf-stats-automated-update-123 (Representative of the ~420–1,000 variants detected)
Network & Infrastructure IOCs
C2 Endpoints
Malicious payloads exfiltrate system data (IP addresses, hostnames, DNS settings, and credentials) to:
Pipedream Endpoints
[unique-id].m.pipedream.net (Used for data collection and reverse shells).
Discord Webhooks
Various Discord-controlled endpoints used for automated data logging.
Proxy/Relay IP
91[.]238[.]181[.]250 (Previously associated with similar npm backdoor payloads).
File & Behavioral Indicators
Persistence Mechanisms
Simple malware variants that execute an overt reverse shell upon installation using postinstall hooks
Tools Used in Campaign
· Malicious JavaScript code executed during the preinstall phase of packages.
CVEs and CVSS Vectors
· None associated
· This is social engineering/malicious code rather than exploiting a specific software vulnerability
Nessus ID
· This has not been tied to CVEs
Patching
· No specific patch, as it relies on developer vigilance and secure practices.
Mitigation Data
· Mitigation involves checking for unknown package updates and rolling/invalidating all credentials (npm tokens, GitHub, AWS, Azure keys) if compromise is suspected.
· Use automated security tools (like Amazon Inspector or OpenSSF registry) for real-time package scanning.
Malware Names
elf-stats-northbound-wishlist-684
Malware Samples
sha256
844013025bf7c5d01e6f48df0e990103ad3c333be31f54cf5301e1463f6ca441
URL Link to sample
· hxxps://www.virustotal.com/gui/file/844013025bf7c5d01e6f48df0e990103ad3c333be31f54cf5301e1463f6ca441
TTPs
Initial Access
· T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
o Mass-publishing hundreds of malicious npm packages (e.g., elf-stats-northbound-wishlist-684) to be inadvertently integrated into developer projects or CI/CD workflows
Execution
· T1059.004: Command and Scripting Interpreter: Unix Shell
o Using malicious postinstall scripts within the package.json file to automatically execute commands upon package installation (npm install)
· T1059.006: Command and Scripting Interpreter: Python
o Utilizing Python-based one-liners to establish reverse shells on compromised systems
Persistence
· T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
o (Observed in Windows-targeted variants) adding entries to startup folders to maintain access across reboots
Discovery
· T1082 System Information Discovery
o Automated gathering of hostnames, IP addresses, network interfaces, and DNS configurations.
· T1087.001 Account Discovery Local Account
o Scanning for local developer usernames and system profiles.
· T1552.001 Unsecured Credentials Credentials In Files
o Searching for sensitive environment variables, .aws/credentials, and .npmrc files containing authentication tokens.
Command and Control (C2)
· T1105: Ingress Tool Transfer
o Downloading secondary payloads or reverse shell scripts from external repositories post-infection.
· T1071.001 Application Layer Protocol Web Protocols
o Exfiltrating stolen data to legitimate service endpoints like Pipedream (*.m.pipedream.net) and Discord Webhooks to blend with normal traffic.
· T1090: Proxy
o Using proxy servers to mask the attacker's true IP address during data exfiltration
Exfiltration
· T1041 Exfiltration Over C2 Channel
o Packaging system metadata and stolen credentials into HTTP POST requests sent directly to attacker-controlled collector endpoints.
Suggested Rules / Potential Hunts
Just as a reminder these are indicator rules they are likely to be noisy
Suggested Suricata Rules
NPM post-install execution
spl
index=os_logs sourcetype=sysmon EVENT_ID=1
| eval process_name=lower(process_name), parent_process_name=lower(parent_process_name)
| where parent_process_name IN ("node.exe", "npm", "node")
AND process_name IN ("cmd.exe", "powershell.exe", "sh", "bash", "python", "python3")
| search process_command IN ("*elf-stats*", "*curl*", "*wget*", "*pipedream*", "*discord.com*")
| stats count by host, user, process_command, parent_process_command
| rename process_command as "Detected_Payload"
Suggested SentinelOne Rules
SentinelOne (S1) Query (EDR/XDR)
Hunt Focus: Look for the "Unsigned Code" or "Suspicious Parent-Child Relationship" alerts specifically involving node spawning python or bash with a network connection
Query (STAR Format):
sql
ParentProcessName == "node.exe" OR ParentProcessName == "npm"
AND (
Commandline Contains "elf-stats"
OR Commandline Contains ".aws/credentials"
OR Commandline Contains ".npmrc"
OR Commandline Contains "env"
)
AND (
Indicator == "Reverse Shell"
OR Indicator == "Suspicious Script Execution"
)
Suggested Splunk Hunts
Detect Pipedream Exfiltration
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE npm elf-stats Campaign Exfiltration (Pipedream)"; flow:established,to_server; content:"POST"; http_method; content:".m.pipedream.net"; http_host; content:"elf-stats"; http_client_body; reference:url,socket.dev/blog/60-malicious-npm-packages-leak-network-and-host-data; classtype:trojan-activity; sid:20251201; rev:1;)
Detect Reverse Shell Activity via Python (Common in elf-stats)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Python Reverse Shell (elf-stats)"; flow:established,from_server; content:"Python"; pcre:"/import\s+socket,os,pty/"; reference:url,cisa.gov/news-events/analysis-reports; classtype:bad-unknown; sid:20251202; rev:1;)
Delivery Method
· Compromised maintainer accounts or social engineering to publish malicious packages to the public NPM registry.
Email Samples
Campaign Delivery Mechanism
Research as of December 2025 indicates that the "elf-" campaign does not primarily utilize a specific "phishing email" for delivery. Instead, it employs the following methods:
· Automated Mass-Publishing: Approximately 1,000 unique packages were published at a rate of one every two minutes from disposable accounts.
· Search Engine/Registry Poisoning: By flooding the npm registry with hundreds of packages containing keywords like "stats," "automated-update," or "northbound," the actors hope developers will inadvertently include these "helper" libraries in their package.json dependencies.
· Dependency Confusion: Some packages target specific internal naming conventions of corporate DevOps environments to be pulled in during automated build processes.
Contextual Email Indicators (Attacker Accounts)
While victims may not receive a direct email, the threat actors used specific email patterns to register their malicious npm accounts. Indicators from the December 2025 wave and similar concurrent campaigns include:
· Throwaway Naming: Accounts created minutes before publication with no linked GitHub or repository history.
· Pattern-Based Registration Emails: Similar campaigns in 2025 used incrementally numbered Gmail accounts for registration (e.g., npm9960+1@gmail.com, npm9960+2@gmail.com).
Comparison: The "Contagious Interview" Lure
It is important to distinguish the automated "elf-" campaign from the "Contagious Interview" campaign (attributed to North Korean actors), which does use direct email and LinkedIn lures.
· Lure Style: Fake job offers or technical coding assessments.
· Example Email Themes: "Senior AI and DevOps Engineer" roles or "Technical screening invitation".
· Payload Delivery: These emails contain links to repositories that require the user to run npm install, which then executes malicious packages similar to the "elf-" variants.
Summary for Defenders: You are more likely to find the "elf-" campaign in your CI/CD logs or dependency manifests than in your email inbox. Any outgoing traffic to *.m.pipedream.net or Discord webhooks originating from a build server should be treated as a high-priority incident.
References
Open Source Malware
hxxps://opensourcemalware.com/blog/elf-stats-spam-campaign
X
https://x.com/pollyplummer/status/1996250889523249396
AWS News
hxxps://aws-news.com/article/2025-12-15-what-aws-security-learned-from-responding-to-recent-npm-supply-chain-threat-campaigns
Wiz IO
hxxps://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
Socket Dev
hxxps://socket.dev/blog/elves-on-npm
CheckMarx
hxxps://checkmarx.com/zero-post/npm-hit-by-shai-hulud-the-self-replicating-supply-chain-attack
Amazon Web Services
hxxps://aws.amazon.com/blogs/security/what-aws-security-learned-from-responding-to-recent-npm-supply-chain-threat-campaigns
VirusTotal
hxxps://www.virustotal.com/gui/file/844013025bf7c5d01e6f48df0e990103ad3c333be31f54cf5301e1463f6ca441
