Shai-Hulud NPM Package Malicious Exfiltration via Curl to Webhook.site

SigmaHQ Detections@sigmaHQ

•updated Oct 19, 2025•3•0•135

Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.