Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)

Hunt Hypothesis

This hunt hypothesis targets adversaries who inject malicious code into widely trusted NPM packages like TinyColor and CrowdStrike to execute supply chain attacks that can silently propagate across multiple environments. Proactively hunting for this behavior in Azure Sentinel is essential because compromised dependencies often bypass traditional perimeter defenses, allowing attackers to establish a foothold within the organization’s internal network before detection occurs.

YARA Rule

rule MAL_JS_NPM_SupplyChain_Compromise_Sep25 {
   meta:
      description = "Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)"
      author = "Florian Roth"
      reference = "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
      date = "2025-09-16"
      modified = "2025-09-17"
      score = 80
      id = "f64fa37b-8445-554a-8442-bd2d42a6643b"
   strings:
      $x1 = "if (plat === \"linux\") return \"https://github.com/trufflesecurity/trufflehog/releases"

      $sa1 = "curl -d \"$CONTENTS\" https://webhook.site/" ascii
      $sa2 = "curl -s -X POST -d \"$CONTENTS\" \"https://webhook.site/"

      $sb1 = " | base64 -w 0 | " ascii
      $sb2 = " | base64 -w0)"
   condition:
      filesize < 20MB
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
      )
      and not uint8(0) == 0x7b  // JSON {
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Supply Chain Compromise in NPM Packages” detection rule, including suggested filters or exclusions:

• Scenario: CI/CD Pipeline Dependency Installation

  • Context: Automated build agents (e.g., Jenkins, GitHub Actions, GitLab Runners) frequently install hundreds of dependencies during nightly builds. When the pipeline executes npm install for a project relying on tinycolor2 or CrowdStrike’s node-agent SDK, the rule may flag these legitimate downloads as potential compromise events due to high download volume and specific package names.
  • Filter/Exclusion: Exclude traffic originating from known CI/CD service account IPs (e.g., 10.50.10.0/24) or filter out events where the source user is a non-interactive service account (e.g., svc-jenkins-build, github-actions[bot]).

• Scenario: Scheduled Security Agent Updates

  • Context: Enterprise endpoints running CrowdStrike Falcon or similar EDR solutions often perform scheduled updates via NPM repositories to fetch the latest sensor definitions and modules. These scheduled jobs (e.g., running every Tuesday at 02:00 AM) trigger the rule because they actively pull specific security-related packages that match the “CrowdStrike” keyword in the detection logic.
  • Filter/Exclusion: Create a time-based exclusion for events occurring during the maintenance window (e.g., 01:30–04:30 UTC) and restrict the rule to only trigger on interactive user sessions, excluding system-level scheduled tasks identified by process names like falcon-sensor-updater.exe.

• Scenario: Developer Local Environment Initialization

  • Context: Developers initializing new local development environments or cloning repositories often run npm install which pulls the full dependency tree. If a developer