Compromised Axios npm package version (1.14.1 and 0.30.4) Malicious plain-crypto-js package directory
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
Microsoft Sentinel (KQL)
