← Back to SOC feed Coverage →

Detects known malicious preinstall script in package.json

yara CRITICAL signature-base
florian-rothnpm_supplychain
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-08-06T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis identifies adversaries who embed malicious preinstall scripts within package.json files to execute unauthorized code during dependency installation phases. Proactively hunting for this behavior in Azure Sentinel is essential because these stealthy scripts often bypass standard static analysis, allowing attackers to establish persistence and exfiltrate data before traditional security controls can intervene.

YARA Rule

rule MAL_NPM_SupplyChain_Attack_PreInstallScript_Nov25 {
   meta:
      description = "Detects known malicious preinstall script in package.json"
      author = "Marius Benthin"
      date = "2025-11-24"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
      score = 80
      id = "eebcf73d-ee26-59c6-aacb-b76232829ea6"
   strings:
      $x1 = "\"preinstall\": \"node setup_bun.js\""
   condition:
      filesize < 10KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects known malicious preinstall script in package.json,” including suggested filters and exclusions:

Original source: https://github.com/Neo23x0/signature-base/blob/main/yara/mal_npm_supply_chain_nov25.yar