Browse detections by severity and log source, with YAML and sample events one click away.
Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.