rule MAL_JS_NPM_SupplyChain_Attack_Nov25 {
   meta:
      description = "Detects malicious JavaScript worm bun_environment.js"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
      score = 80
      id = "11726cbe-48a7-577a-9694-8f38ffa746e1"
   strings:
      $sa1 = "npm publish"
      $sa2 = "NPM_TOKEN"
      $sa3 = "NPM_CONFIG_TOKEN"

      $sb1 = "GITHUB_"
      $sb2 = "GITLAB_"
      $sb3 = "TEAMCITY_"
   condition:
      filesize < 20MB
      and all of ($sa*)
      and 2 of ($sb*)
}

rule SUSP_JS_NPM_Sha1_Hulud_Nov25 {
   meta:
      description = "Detects suspicious indicators for Sha1 Hulud worm"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
      score = 70
      id = "511fa6ca-25fe-57d4-a910-277c92d65e4a"
   strings:
      $x1 = "Sha1-Hulud:\\x"
      $x2 = "SHA1HULUD\"`"
   condition:
      filesize < 20MB
      and 1 of them
}

rule SUSP_JS_NPM_SetupScript_Nov25 {
   meta:
      description = "Detects suspicious JavaScript which exits silently and checks operating system"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
      score = 70
      id = "2d102efd-681a-5af1-b4fe-3489e5e7f8f2"
   strings:
      $sa1 = "require('child_process')"
      $sa2 = "process.platform ==="

      $sb1 = "().catch((e"
      $sb2 = "process.exit(0)"
   condition:
      filesize < 100KB
      and all of ($sa*)
      and $sb1 in (filesize - 50..filesize)
      and $sb2 in (filesize - 30..filesize)
}

rule MAL_NPM_SupplyChain_Attack_PreInstallScript_Nov25 {
   meta:
      description = "Detects known malicious preinstall script in package.json"
      author = "Marius Benthin"
      date = "2025-11-24"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
      score = 80
      id = "eebcf73d-ee26-59c6-aacb-b76232829ea6"
   strings:
      $x1 = "\"preinstall\": \"node setup_bun.js\""
   condition:
      filesize < 10KB
      and all of them
}