Gabriel Taveira GSTJ
GSTJ
/ detect-infection.sh
Last active
February 12, 2026 01:13
NPM Supply Chain Malware Scanner (Cross-Chain TxDataHiding / OmniStealer / DPRK APT) - Detects blockchain C2 malware, IDE injection, credential theft. Based on Ransom-ISAC YARA rules. 16 detection checks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # NPM Supply Chain Malware Detection Script (Cross-Chain TxDataHiding / OmniStealer) | |
| # Reference: https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-2/ | |
| # YARA Rules: Actor_APT_DPRK_Unknown_MAL (Ransom-ISAC) | |
| # Detects malware variant that spreads via compromised npm packages | |
| # Usage: ./detect-infection.sh | |
| RED='\033[0;31m' | |
| GREEN='\033[0;32m' | |
| YELLOW='\033[1;33m' |
GSTJ
/ detect-infection.sh
Last active
February 11, 2026 20:55
NPM Supply Chain Malware Detection Script - Detects blockchain C2 malware spread via compromised npm packages (tailwind.config.ts, next.config.ts). Checks for: node -e processes, C2 connections (198.105.127.*), hidden ~/.node_modules persistence, blockchain RPC endpoints.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # NPM Supply Chain Malware Detection Script | |
| # Detects malware variant that spreads via compromised npm packages | |
| # Targets: tailwind.config.ts, next.config.ts, and similar config files | |
| # IOCs: Blockchain C2 (Tron, Aptos, BSC), hidden ~/.node_modules persistence | |
| # Usage: ./detect-infection.sh | |
| RED='\033[0;31m' | |
| GREEN='\033[0;32m' | |
| YELLOW='\033[1;33m' |