MYRA npm Self-Upgrade Package Overwrite Post-Install (Polymarket Trap)
This rule detects potentially malicious self-upgrade patterns in Node.js applications, specifically monitoring for the execution of scripts like 'sync-peer.cjs', the use of 'BACKUP_TARGET_VERSION' environment variables, or npm packaging commands initiated via lifecycle hooks (e.g., 'postinstall'). These behaviors are characteristic of supply chain attacks or automated persistence mechanisms that attempt to replace or upgrade application code during the installation or execution process.
Splunk (SPL)
