This hunt hypothesis identifies adversaries who embed malicious preinstall scripts within package.json files to execute unauthorized code during dependency installation phases. Proactively hunting for this behavior in Azure Sentinel is essential because these stealthy scripts often bypass standard static analysis, allowing attackers to establish persistence and exfiltrate data before traditional security controls can intervene.
rule MAL_NPM_SupplyChain_Attack_PreInstallScript_Nov25 {
meta:
description = "Detects known malicious preinstall script in package.json"
author = "Marius Benthin"
date = "2025-11-24"
reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
score = 80
id = "eebcf73d-ee26-59c6-aacb-b76232829ea6"
strings:
$x1 = "\"preinstall\": \"node setup_bun.js\""
condition:
filesize < 10KB
and all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the rule “Detects known malicious preinstall script in package.json,” including suggested filters and exclusions:
CI/CD Pipeline Artifact Installation
package.json template containing a preinstall script to validate license keys before installation. These scripts often mimic the signature of known malicious patterns due to shared boilerplate code.github-actions[bot], jenkins-agent) or restrict detection to exclude files located within specific build artifact directories (e.g., /builds/artifacts/*).Internal Developer Tooling Updates
preinstall script that checks for specific Node.js versions and installs local dependencies, which matches the rule’s heuristic for malicious preinstall behavior.C:\Program Files\InternalDevTools\cli) or filter out events where the initiating process is a known configuration management daemon (e.g., Ansible, Chef-client).Third-Party Enterprise SaaS Integration