Node/Bun process contacting both GitHub API and npm registry (Shai-Hulud worm)
Detects Node or Bun processes connecting to both api.github.com and registry.npmjs.org within a 30-minute window on the same device, which can indicate malicious activities such as automated credential validation, repository creation, and package publishing typical of supply chain worms.
Microsoft Sentinel (KQL)
