MAL_JS_NPM_SupplyChain_Attack_Nov25

rule MAL_JS_NPM_SupplyChain_Attack_Nov25 {
   meta:
      description = "Detects malicious JavaScript worm bun_environment.js"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
      score = 80
      id = "11726cbe-48a7-577a-9694-8f38ffa746e1"
   strings:
      $sa1 = "npm publish"
      $sa2 = "NPM_TOKEN"
      $sa3 = "NPM_CONFIG_TOKEN"

      $sb1 = "GITHUB_"
      $sb2 = "GITLAB_"
      $sb3 = "TEAMCITY_"
   condition:
      filesize < 20MB
      and all of ($sa*)
      and 2 of ($sb*)
}