Ottercookie Infostealer across NPM

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 25, 2026•4•0•134

This rule detects instances where a 'node.exe' process initiates an outbound network connection over HTTPS (port 443) to a domain within the '.vercel.app' top-level domain. This could indicate development activity, but also potential malicious use of Node.js applications for command and control or data exfiltration to cloud services.