Miasma npm Supply Chain - Malicious Install Hook via node.exe or bun.exe
Detects malicious execution patterns during npm package installation consistent with Miasma and Mini Shai-Hulud supply chain attacks. The rule monitors for node.exe or bun.exe being spawned by npm or node-gyp that exhibit suspicious behavior, such as accessing sensitive credential paths (e.g., .ssh, .npmrc, .gitconfig) or utilizing a Phantom Gyp execution pattern where index.js is executed directly within node_modules via node-gyp, as well as bun.exe staging execution from temporary directories.
Sigma
