Miasma czirker/llxlr LeoPlatform npm Malicious Package Publish Detection
Detects an anomalous volume of NPM package publications by specific users associated with internal naming conventions (leo-*, @leoplatform/*, verana-blockchain*). The rule identifies potential supply chain compromise attempts by monitoring for burst activity (3+ publishes or 3+ unique packages within a 10-second window).
Splunk (SPL)
