Package Manager Network Connection to Non-Canonical Registry Domain
Detects instances where common package management utilities (pip, npm, wget, curl) establish network connections to domains outside of verified official package registry endpoints. This pattern is often used in software supply chain attacks to retrieve malicious packages from attacker-controlled infrastructure.
Sigma
