SIGNATURE_BASE_SUSP_JS_Dropper_Mar26

rule SIGNATURE_BASE_SUSP_JS_Dropper_Mar26 : FILE
{
	meta:
		description = "Detects suspicious JavaScript dropper used in plain-crypto-js supply chain attacks"
		author = "Marius Benthin"
		id = "456a52c2-9cbf-572f-9a5b-b8d74183e3f4"
		date = "2026-03-31"
		modified = "2026-05-15"
		reference = "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_mar26.yar#L19-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"
		logic_hash = "9dad4bef8cf31a91240dbbc438eff2640389424db9f75be2d897d745133785ee"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$sa1 = "Buffer.from("
		$sa2 = "FileSync("
		$sa3 = ".replaceAll("
		$sb1 = ".arch()"
		$sb2 = ".platform()"
		$sb3 = ".release()"
		$sb4 = ".type()"

	condition:
		filesize < 10KB and all of ( $sa* ) and 2 of ( $sb* )
}