SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Preinstallscript_Nov25

rule SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Preinstallscript_Nov25 : FILE
{
	meta:
		description = "Detects known malicious preinstall script in package.json"
		author = "Marius Benthin"
		id = "eebcf73d-ee26-59c6-aacb-b76232829ea6"
		date = "2025-11-24"
		modified = "2026-05-15"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L66-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
		logic_hash = "7472fc4759bbf03abd05a0eade1144c7ca3ab31af26ed4eab4028056027b2e47"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "\"preinstall\": \"node setup_bun.js\""

	condition:
		filesize < 10KB and all of them
}