rule bulwark_https_bulwarkblack_com_npm_dependency_confusion_recon_supply_chain_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/npm-dependency-confusion-recon-supply-chain-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "22"
    strings:
        $s0 = "cloudplatform-single-spa.io" ascii wide nocase  // Domains
        $s1 = "docs.cloudplatform-single-spa.io" ascii wide nocase  // Domains
        $s2 = "docs.t-in-one.io" ascii wide nocase  // Domains
        $s3 = "github.cloudplatform-single-spa.io" ascii wide nocase  // Domains
        $s4 = "jira.cloudplatform-single-spa.io" ascii wide nocase  // Domains
        $s5 = "jira.t-in-one.io" ascii wide nocase  // Domains
        $s6 = "moika.tech" ascii wide nocase  // Domains
        $s7 = "npm.t-in-one.io" ascii wide nocase  // Domains
        $s8 = "obfuscator.io" ascii wide nocase  // Domains
        $s9 = "oob.moika.tech" ascii wide nocase  // Domains
        $s10 = "t-in-one.io" ascii wide nocase  // Domains
        $s11 = "https://docs.cloudplatform-single-spa.io/platform/svp-baas" ascii wide nocase  // URLs
        $s12 = "https://github.cloudplatform-single-spa.io/platform/svp-baas.git" ascii wide nocase  // URLs
        $s13 = "https://jira.cloudplatform-single-spa.io/projects/PLATFORM" ascii wide nocase  // URLs
        $s14 = "https://oob.moika.tech/payload" ascii wide nocase  // URLs
        $s15 = "https://oob.moika.tech/payload/linux" ascii wide nocase  // URLs
        $s16 = "https://oob.moika.tech/payload/mac" ascii wide nocase  // URLs
        $s17 = "https://oob.moika.tech/payload/win" ascii wide nocase  // URLs
        $s18 = "mr.4nd3r50n@yandex.ru" ascii wide nocase  // Email Addresses
        $s19 = "ogvanta@yandex.ru" ascii wide nocase  // Email Addresses
        $s20 = "platform@cloudplatform-single-spa.io" ascii wide nocase  // Email Addresses
        $s21 = "t-in-one@yandex.ru" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*)
}