Blockchain C2 Lookup By JS Runtime in Temp

Detects execution of Node.js or Bun from a temporary directory performing DNS queries for public Ethereum JSON-RPC provider domains, a technique observed in supply chain compromise payloads such as Shai-Hulud and ChainDrop to resolve command and control endpoints.