Detects package.json which include the malicious plain-crypto-js package as dependency

Hunt Hypothesis

This hunt identifies Node.js applications that have integrated the compromised plain-crypto-js package into their package.json, signaling a potential supply chain attack where adversaries inject malicious code to compromise cryptographic operations. Proactively hunting for this dependency in Azure Sentinel is critical because it allows the SOC team to detect and remediate exposure before attackers can leverage the vulnerable library to execute remote code or intercept sensitive data within the cloud environment.

YARA Rule

rule MAL_NPM_SupplyChain_Attack_Mar26 {
   meta:
      description = "Detects package.json which include the malicious plain-crypto-js package as dependency"
      author = "Marius Benthin"
      date = "2026-03-31"
      reference = "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"
      hash = "5e3e89c7351f385e36bb70286866a62957cc1aaab195539edb8c7bb62968a137"
      score = 80
      id = "88e7af97-f7c1-591e-960c-d5296da94066"
   strings:
      $s1 = "\"dependencies\":"
      // This is the specific malicious package that was added to the npm registry, which is a typo-squatting of the popular crypto-js package
      $s2 = { 22 70 6C 61 69 6E 2D 63 72 79 70 74 6F 2D 6A 73 22 3A [0-3] 22 [0-2] 34 2E 32 2E }  // "plain-crypto-js": "^4.2."
   condition:
      filesize < 10KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule detecting plain-crypto-js in package.json, along with suggested filters or exclusions:

• Legacy Third-Party Microservice Onboarding

  • Scenario: A DevOps engineer provisions a new microservice (e.g., an internal billing gateway) using a legacy Docker image template that was built six months ago. This template includes plain-crypto-js as a transitive dependency within the node_modules of the build container, which is subsequently scanned by the CI/CD pipeline before deployment to production.
  • Filter/Exclusion: Exclude any package.json files located in directories matching the pattern /ci-build-artifacts/* or /docker-images/templates/*. Alternatively, add a filter to ignore alerts where the file modification timestamp is older than 30 days and the directory path contains “templates” or “legacy”.

• Scheduled Dependency Audit Job

  • Scenario: The enterprise runs a nightly scheduled job using Ansible Tower or Jenkins that scans all active Node.js repositories to generate a dependency risk report. During this scan, the automation tool reads and parses every package.json in the repository tree, triggering the detection rule for every instance of the package found, even if no new code was committed.
  • Filter/Exclusion: Create an exclusion based on the source process name or user account. Filter out alerts generated by service accounts such as svc-ansible-runner, jenkins-agent-01, or gitlab-ci-runner when they are performing read-only operations (no write events associated with the trigger).

• Internal Developer Sandbox Environment

  • Scenario: A team of developers is actively prototyping a new feature in a “Sandbox” branch within their Git repository. They have temporarily added plain-crypto-js to test specific