SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Attack_Nov25

rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Attack_Nov25 : FILE
{
	meta:
		description = "Detects malicious JavaScript worm bun_environment.js"
		author = "Marius Benthin"
		id = "11726cbe-48a7-577a-9694-8f38ffa746e1"
		date = "2025-11-24"
		modified = "2025-12-15"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L1-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
		logic_hash = "b5a8da01ecb31dfa7a3921847a0fe26021b7618b1ee7a115a366b0854a4fa0a8"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$sa1 = "npm publish"
		$sa2 = "NPM_TOKEN"
		$sa3 = "NPM_CONFIG_TOKEN"
		$sb1 = "GITHUB_"
		$sb2 = "GITLAB_"
		$sb3 = "TEAMCITY_"

	condition:
		filesize < 20MB and all of ( $sa* ) and 2 of ( $sb* )
}