Sapphire Sleet - NPM Postinstall TLS Bypass
Detects npm postinstall execution with TLS certificate verification bypass characteristic of Sapphire Sleet's supply chain attack. The malicious postinstall script disables certificate validation before contacting C2 infrastructure.
YARA-L
