Lazarus Malicious Open-Source Package Installation
This rule detects the installation of specific malicious open-source packages using npm or pip. It looks for process executions of 'npm.exe', 'pip.exe', 'pip3.exe', 'npm', or 'pip3' with 'install' in their command line, specifically targeting known malicious package names like 'winston-compose', 'nodemailer-helper', 'servula', 'velocky', 'vite-postcss-helper', 'pycryptoconf', and 'pycryptoenv'. This activity is indicative of supply chain compromise attempts, potentially by groups like Lazarus Group, who have been known to leverage such tactics.
Sigma
