Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Preinstallscript_Nov25

Detects known malicious preinstall script in package.json

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Marius Benthin
Date
2025-11-24
Modified
2026-05-15
Score / Quality
80 / 85

What this rule detects

Detects known malicious preinstall script in package.json

It defines 1 patterns (1 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-npm-supplychain-attack-preinstallscript-nov25.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Preinstallscript_Nov25 : FILE
{
	meta:
		description = "Detects known malicious preinstall script in package.json"
		author = "Marius Benthin"
		id = "eebcf73d-ee26-59c6-aacb-b76232829ea6"
		date = "2025-11-24"
		modified = "2026-05-15"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L66-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
		logic_hash = "7472fc4759bbf03abd05a0eade1144c7ca3ab31af26ed4eab4028056027b2e47"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "\"preinstall\": \"node setup_bun.js\""

	condition:
		filesize < 10KB and all of them
}

Strings (1 patterns)

IdentifierTypeValueModifiers
$x1text"\"preinstall\": \"node setup_bun.js\""

Condition

filesize < 10KB and all of them

In plain words (Heuristic)

  • The file must be smaller than 10KB (a cheap guard that skips large files).
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865

Licence & attribution

Author: Marius Benthin

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: eebcf73d-ee26-59c6-aacb-b76232829ea6

Tags:FILE

Related rules