/*
 * IronWorm / jscrambler npm supply-chain compromise (2026-07-11)
 * Written from static analysis in this repo's writeup.md; validated with
 * `yara -r ironworm.yar <path>` against the samples described there.
 * References: OSV MAL-2026-10187, GHSA-v3g3-4x77-rw68
 */

rule NPM_jscrambler_IronWorm_container
{
    meta:
        description = "Custom multi-platform binary container (dist/intro.js) used to smuggle the IronWorm native payload inside the compromised jscrambler npm package"
        reference = "OSV MAL-2026-10187"
        hash_intro_js = "a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86"

    strings:
        $magic = { 1B 43 53 49 01 }

    condition:
        $magic at 0
}

rule NPM_jscrambler_IronWorm_js_loader
{
    meta:
        description = "JS-side loader logic that reads the intro.js container and spawns the platform-matched native binary. Matches both the 8.14.0 preinstall (dist/setup.js) and 8.18.0+ runtime-IIFE (dist/index.js / dist/bin/jscrambler.js) variants."
        reference = "OSV MAL-2026-10187"

    strings:
        $magic_bytes = "0x1b, 0x43, 0x53, 0x49, 0x01" ascii
        $platform_map = "PLATFORM_IDS" ascii
        $spawn_detached = "detached: true" ascii
        $spawn_windowshide = "windowsHide" ascii
        $unref = ".unref()" ascii

    condition:
        $magic_bytes and $platform_map and $spawn_detached and ($spawn_windowshide or $unref)
}

rule IronWorm_Rust_infostealer_payload
{
    meta:
        description = "Native Rust IronWorm infostealer payload dropped by the compromised jscrambler npm package (Linux/Windows/macOS builds). Combination chosen to be distinctive: wallet seed-phrase harvesting + cloud IMDS targeting + the malware's own JSON C2 protocol, unlikely to co-occur in legitimate software."
        reference = "OSV MAL-2026-10187, safedep.io jscrambler-npm-supply-chain-compromise"
        hash_linux = "fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd"
        hash_windows = "b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903"
        hash_macos = "c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd"

    strings:
        $bip39 = "bip39_english" ascii
        $mnemonic = "general_mnemonic" ascii
        $ec2_imds = "ec2-imds" ascii
        $proto_out = "{\"t\":\"out\",\"id\":\"" ascii
        $proto_done = "{\"t\":\"done\",\"id\":\"" ascii
        $steam = "steamLoginSecure" ascii

    condition:
        2 of ($bip39, $mnemonic, $ec2_imds, $proto_out, $proto_done, $steam)
}