import "hash"

rule bulwark_https_bulwarkblack_com_red_hat_miasma_npm_supply_chain_trusted_publishing_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/red-hat-miasma-npm-supply-chain-trusted-publishing-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:56:51Z"
        tlp = "TLP:CLEAR"
        indicator_count = "4"
    strings:
        $s0 = "www.aikido.dev" ascii wide nocase  // Domains
        $s1 = "https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "0c5077e51419868618aeaa5fe8019c62421857d6" or
        hash.sha1(0, filesize) == "de0fac2e4500dabe0009e67214ff5f5447ce83dd"
}