Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025

Hunt Hypothesis

This hunt hypothesis targets adversaries who inject obfuscated JavaScript into compromised NPM packages to execute stealthy cryptocurrency wallet theft within the software supply chain. Proactively hunting for this behavior in Azure Sentinel is essential to identify and neutralize these sophisticated crypto-stealing attacks before they compromise developer environments and exfiltrate sensitive digital assets.

YARA Rule

rule MAL_JS_NPM_SupplyChain_Attack_Sep25 {
   meta:
      description = "Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025"
      author = "Florian Roth"
      reference = "https://www.linkedin.com/feed/update/urn:li:activity:7370889385992437760/"
      date = "2025-09-09"
      modified = "2025-11-29"
      score = 85
      hash1 = "16f6c756bc8ce5ef5d9aa1ded0f811ec0c9cee3d8f85cc151b8ca1df7b8a4337"
      id = "f083233e-348a-5b7d-a128-181c543a279c"
   strings:
      $x1 = "const _0x112fa8=_0x180f;(function(_0x13c8b9" ascii

      $fp1 = "<html"
      $fp2 = "<xml "
      $fp3 = "<?xml"
   condition:
      filesize < 200KB
      and 1 of ($x*)
      and not 1 of ($fp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the rule “Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks,” along with suggested filters and exclusions:

Scenario: Legitimate Minification of Frontend Bundles by Build Tools
- Context: During nightly CI/CD pipelines, tools like Webpack, Rollup, or Vite automatically minify and obfuscate JavaScript bundles (e.g., app.min.js, vendor.bundle.js) to reduce file size. These build artifacts often contain high entropy strings and complex control flow that mimic the signature of malicious supply chain attacks.
- Filter/Exclusion: Exclude NPM packages installed within known CI/CD runner containers (e.g., GitHub Actions runners, Jenkins agents) or filter out files matching specific naming conventions like *.min.js or *.bundle.js located in standard artifact directories (dist/, build/).
Scenario: Scheduled Maintenance Scripts Using Obfuscated Third-Party Libraries
- Context: Enterprise scheduled jobs (e.g., running via Cron on Linux or Task Scheduler on Windows) often utilize heavy third-party libraries for reporting or data transformation. For instance, a nightly financial reconciliation job might use an obfuscated version of the Chart.js or D3.js library to generate PDF reports, triggering the detection due to the library’s inherent code density and variable renaming.
- Filter/Exclusion: Create an exclusion list for known benign NPM package names (e.g., chart.js, d3, lodash) when executed by specific service accounts (e.g., svc-finance-reporting) or during defined maintenance windows (e.g., 02:00–04:00 UTC).
**Scenario: Deployment of Enterprise Single Sign-On (SS