Benign Download

4b/12/4b125330e67941ab5d72d2c6890da8eeea222e725b2b83fe48173fc9c5b12c45

Hidden path prefix in /tmpComposite catalog lists alternative rules

SHA-2564b125330e67941ab5d72d2c6890da8eeea222e725b2b83fe48173fc9c5b12c45

Evidence

Top-level traits or composite_rules key lines 1–40

1defaults:
2  platforms: [openwrt]
3  for: [javascript, typescript]
4  attack: T1195.002
5
6traits:
7  - id: node-package-install-hook-write
8    desc: Node writes package install lifecycle hook
9    crit: suspicious
10    conf: 0.92
11    if:
⋯13 lines
25    if:
26      type: text
27      substr: /tmp/.cache/trojan-package
28
29composite_rules:
⋯11 lines