Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
259 detections
Filters
Last updated
All Time
Detection languages
127
47
23
16
14
Contributors
71
45
44
36
14
Categories
135
108
46
44
31
Platforms
176
147
110
22
10
Products / Services
68
57
39
34
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
5
1
IDS Protocols
4
2
Detects the scope-squatted package preinstall script executing the Claude CLI to harvest the developer's authenticated session email. Specifically, it looks for 'node.exe' as the initiating process, executing a process named 'claude' or a process with 'auth' and 'status' in its command line.
Detects shell/script execution from .git/hooks/ paths, especially when spawning network-connected or unusual child processes. This activity is indicative of Lazarus Group exploiting Git Hooks for persistence and credential theft within developer environments.
This rule detects the targeted extraction of NPM authentication tokens by monitoring process command lines for the string 'npm_' and correlating it with network connections to a specific IP address (216.126.225.129). This behavior is associated with the Megalodon CI/CD malware.
Detects GitHub Actions workflow files that include 'id-token: write' permissions in conjunction with 'npm publish' or 'yarn publish' commands. This pattern is indicative of the Miasma worm (also known as the wshu.net campaign) which abuses OIDC trusted publishing to facilitate unauthorized npm package propagation. The rule also identifies workflows that attempt to fallback on legacy NPM_TOKEN secrets.
This rule detects the dropping of a 24-character hexadecimal JavaScript payload followed by the creation of a '.pkg_history' or '.pkg_logs' marker file within a one-minute timeframe. This behavior is indicative of the Mastra NPM supply chain compromise.
Detects npm.cmd or npx.cmd directly spawning the bun.exe payload runtime, which could indicate a supply chain attack or malicious package execution.
Detects the execution of Node.js build processes (node-gyp) or npm build commands involving native module compilation. These patterns are often indicative of legitimate development workflows but are also leveraged by attackers to compile malicious native add-ons or execute arbitrary code in a build environment.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
This rule detects potential supply chain attacks where a Node.js process (npm, npx, node) triggers an unauthorized shell, scripting interpreter, or network utility (such as curl, wget, powershell, or bash) to execute commands. This behavior, when followed by file creation in temporary directories (e.g., /tmp, AppData\Local\Temp) within a 5-minute window, is indicative of malicious npm postinstall hooks, commonly seen in supply chain compromise campaigns.
Detects when common package management tools (npm, pip, nuget, python) spawn potentially malicious child processes such as cmd.exe, powershell.exe, curl.exe, or certutil.exe. This activity is a classic indicator of supply chain attacks where a compromised dependency or installation hook attempts to execute arbitrary commands or download secondary payloads on a developer or build machine.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
Detects node.exe initiating outbound network connections to external IPs/domains shortly after an npm.exe or npx.exe process event, excluding common legitimate NPM and GitHub domains. This behavior is indicative of supply chain compromise where malicious NPM packages might execute code and establish C2 communication.
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Detects indicators of the June 2026 Mastra npm supply chain attack, in which
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
This rule detects the combination of a Node.js process reading a JavaScript file with a 24-character hexadecimal filename, immediately followed by outbound network communication to known command and control (C2) IP addresses associated with the 'easy-day-js' campaign. This behavior is indicative of the Mastra NPM supply chain compromise.
Correlates the drop of a 24-character hex .js file with its immediate execution by node.exe, indicating potential compromise via a supply chain attack like Mastra NPM.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects outbound network connections to the attacker-controlled infrastructure
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Page 10 of 13