GHAPPIER npm loader indexe.cjs malicious payload

Ibrahim Saud@tektrix

•updated 19 days ago•0•0•1

This rule detects the GHAPPIER multi-stage loader, typically observed in 'indexe.cjs' files. The loader fetches and executes a remote payload from a Vercel-hosted domain (primevector-app924560.vercel.app) using 'eval' on retrieved content, or matches specific payload identification tags.