Easydayjs Npm Supply Chain Attack Dropper

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•5•0•30

Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.