VE-Detection-Guide — AI Coding Agent Supply Chain Attack Surface
Classification: TLP:CLEAR Researcher: VertexElite Security Research Date: June 13, 2026 Context: Companion to ClawHavoc/OpenClaw Submission (May 2, 2026) GitHub: github.com/VertexElite/miasma-detection Scope: Detection only — no exploit code, no unreleased IOCs
Campaign Summary: Miasma/Shai-Hulud (June 1–13, 2026)
Self-propagating supply chain worm campaign across npm and PyPI ecosystems, targeting AI coding agent platforms as both delivery and persistence mechanisms.
- 32 RedHat npm packages (@redhat-cloud-services), 96 malicious versions, ~117,000 weekly downloads
- 57 Phantom Gyp packages, 286 malicious versions
- Valid OIDC-issued npm tokens with SLSA provenance attestations throughout
Original Contribution: 5-Level Attack Surface Ladder
| Level | Vector | Trigger | Defenses Bypassed | Status |
|---|---|---|---|---|
| 1 | Preinstall hook (npm scripts) | npm install | None — caught by hook monitoring | Observed — Wave 1 Jun 1 |
| 2 | Phantom Gyp (binding.gyp) | node-gyp rebuild | Preinstall/postinstall monitoring | Observed — Wave 2 Jun 3 |
| 3 | AI agent SessionStart hook | Agent session start | Registry-level scanners | Observed — Wave 3 Jun 3–5 |
| 4 | MCP data poisoning (AgentJacking) | MCP tool call | EDR, WAF, IAM, firewalls | Disclosed Jun 12 2026 |
| 5 | No-tool-call file injection (CLAUDE.md etc.) | Agent reads file | All of the above | Architectural — not yet observed |
Each wave studied defenses deployed after the prior wave and engineered around them.
Key Detection Rule
Phantom Gyp zero-false-positive detection:
Any package with binding.gyp + type:none + zero C/C++ source files = definitionally malicious
This single rule would have caught Wave 2 entirely.
Wave Details
Wave 1 — Preinstall Hook (Jun 1)
- RedHat @redhat-cloud-services compromise (10:53 UTC and 13:44 UTC)
- 4.2 MB obfuscated JavaScript payload at install time
Wave 2 — Phantom Gyp (Jun 3)
- binding.gyp command substitution technique
- type:none with no C/C++ sources running payload through Bun
- Bypasses preinstall/postinstall monitoring entirely
Wave 3 — AI Agent SessionStart Hooks (Jun 3–5)
- Targets .claude/ and .gemini/ directories
- Poisoned hook injection at agent session start
- Bypasses registry-level scanners
Wave 4 — AgentJacking / MCP Data Poisoning (Jun 12)
- Disclosed by Tenet Security
- 85% exploitation success rate, 2,388 organizations exposed
- Sentry MCP integration used as vector
- Sentry declined to fix
Level 5 — No-Tool-Call File Injection (Architectural)
- CLAUDE.md/GEMINI.md auto-loading into context at session start
- Zero infrastructure requirements — pure prompt injection via filesystem
- Not yet observed in wild but structurally confirmed
Cross-Contamination Risk
gemini hooks migrate --from-claude — Gemini CLI migration command copies Claude hooks, enabling cross-platform propagation.
Published Detection Assets
GitHub Repository (VertexElite/miasma-detection)
- 3 bash detection scripts
- 3 Sigma YAML files
- IOC CSV
- Network block list
- Detailed documentation
Sigma Rules (3)
- Wave 1 preinstall hook detection
- Phantom Gyp binding.gyp detection
- SessionStart hook injection detection
Disclosure Distribution
| Recipient | Channel | Response |
|---|---|---|
| Anthropic T&S (Jamie) | usersafety@anthropic.com | Auto-reply only |
| GitHub Security | security@github.com | Auto-acknowledgment #148111 |
| npm Security | HackerOne (hackerone.com/npm) | — |
| Ravie Lakshmanan | ravie@thehackernews.com | — |
| Google Security | security@google.com | — |
Published by VertexElite Security Research · research@vertexelite.org