npm install/postinstall outbound calls to unusual destinations (Shai-Hulud/Miasma) - tightened
Detects npm install/ci/postinstall or publish process activity correlated within a short time window to outbound network connections toward destinations that are not on the known-safe npm registry/CDN allowlist and are not recognized internal mirrors, indicative of malicious npm packages (Shai-Hulud/Miasma) exfiltrating tokens/credentials or beaconing to attacker infrastructure during package install or propagation.
Microsoft Sentinel (KQL)
