ATT&CK T1195 - Suspicious Package Registry DNS (typosquat)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects DNS queries for typosquatted domains related to npmjs. Specifically, it looks for queries to domains ending in 'npmjs.net', 'npmjs.org', 'npmjs.io', or 'npmjs.co'. This is indicative of potential supply chain attacks or attempts to trick users into downloading malicious packages from fake registries.