Benign Download

package-manager.yaml

Composite catalog lists alternative rulesComposite catalog requires rule references
SHA-2567e297e70a1a1854d69683427a36cd28c093a8fd1f7e6b2df577fccdcb959314d
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–15
1:8… s:
2 platforms:
3 - unix
4 - windows
5 for: [scripts, binaries]
6 crit: suspicious
7 attack: T1552.001
8traits:
9- id: pypirc-read
10 desc: Reads .pypirc file
11 crit: suspicious
⋯4 lines
Secret-data term token lines 30–35
30:13… ms-api-key-var
31 desc: RubyGems API key variable
32 crit: notable
33 conf: 0.85
34 if:
35 type: string_li …
Hidden path under HOME variable lines 216–222
216:8… ex: cat\s+[^<\n]{0,30}\.npmrc
217 not:
218 - substr: 'cat << EOF > "$HOME/.npmrc"'
219 - regex: 'cat\s+<<\s*EOF\s*>\s*"\$HOME/\.npmrc"'
220 - regex: 'cat\s*<<\s*\w+\s*>\s*"\$HOME/\.npmrc"'
221- id: shell-cat-pypirc
222 …
Data-transfer verb token lines 307–309
307:38… npmrc[\s\S]{0,120}axios\s*\.\s*(post|put|request)\s*\('
308- id: js-npmrc-readfilesync-to-axios
309 desc: …
Environment or instruction terminology lines 625–630
625:7… js-env-home-var
626 desc: JS home environment variable
627 crit: component
628 conf: 0.85
629 any:
630 - id: micro-behaviors/o …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.