deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir
Repository: SigmaHQ/sigma
Severity: critical
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
Date: 2026-04-17
ATT&CK techniques: T1036.005
Log source: windows/file_event

Description:
Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains the RS- prefix characteristic
of RedSun's staging directory (e.g. %TEMP%\RS-{GUID}\TieringEngineService.exe).
RedSun registers a Cloud Files sync root under this RS-prefixed path and drops a masqueraded placeholder there as part of its oplock-based AV bypass and privilege escalation chain.

The RS-{GUID} directory name is generated by RedSun itself and has no legitimate system usage,
making the combination of this path prefix and the TieringEngineService.exe filename a highly
specific indicator of RedSun activity.


Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      "\\Temp",
      "\\RS-{"
    ],
    "TargetFilename|endswith": "\\TieringEngineService.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
  - https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
Sigma Detection Rule: RedSun - TieringEngineService.exe Detected as EICAR Test File
Repository: SigmaHQ/sigma
Severity: critical
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-17
ATT&CK techniques: T1036.005, T1685, T1055
Log source: windows/

Description:
Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe
dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present.
This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based
AV bypass/privilege escalation tool.

RedSun works as follows:
  1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\
  2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger
     a Defender scan and remediation attempt
  3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file
  4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open
  5. During the oplock break window, RedSun swaps the mount point (junction) to redirect
     \\?\C:\Windows\System32 to the attacker-controlled temp path
  6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges


Detection logic:
{
  "selection_eid": {
    "EventID": 1119,
    "SourceName": "Real-Time Protection"
  },
  "selection_susp_path": {
    "Path|endswith": "\\TieringEngineService.exe",
    "ThreatName|endswith": "EICAR_Test_File"
  },
  "selection_susp_process": {
    "ProcessName|endswith": "\\RedSun.exe"
  },
  "condition": "selection_eid and 1 of selection_susp_*"
}

References:
  - https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L605
  - https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
Sigma Detection Rule: RedSun - Named Pipe Created
Repository: SigmaHQ/sigma
Severity: critical
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
Date: 2026-04-17
ATT&CK techniques: T1055, T1685
Log source: windows/pipe_created

Description:
Detects the creation of a named pipe with the hardcoded name "REDSUN".
The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain.
RedSun creates the pipe as \\??\pipe\REDSUN.
The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM.
Presence of this pipe name indicates active or recent RedSun execution.


Detection logic:
{
  "selection": {
    "PipeName": "\\REDSUN"
  },
  "condition": "selection"
}

References:
  - https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
  - https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
Sigma Detection Rule: Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-28
ATT&CK techniques: T1187
Log source: windows/process_creation

Description:
Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:).
An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource.
When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash.
HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access.
The URI can be delivered via a malicious hyperlink, phishing email, or web page.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\SnippingTool.exe",
    "CommandLine|contains": [
      "ms-screensketch:edit?&filePath=\\\\\\\\",
      "ms-screensketch:edit?&filePath=%%5C",
      "ms-screensketch:edit?&filePath=%5C",
      "ms-screensketch:edit?&filePath=http"
    ]
  },
  "condition": "selection"
}

References:
  - https://x.com/BlackArrowSec/status/[PII_REDACTED]491424508
  - https://x.com/SBousseaden/status/[PII_REDACTED]721997635
Sigma Detection Rule: LiteLLM / TeamPCP Supply Chain Attack Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-30
ATT&CK techniques: T1195.002, T1560.001, T1543.002
Log source: linux/process_creation

Description:
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8).
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.


Detection logic:
{
  "selection_pth_package": {
    "Image|contains": "/python3",
    "CommandLine|contains|all": [
      "exec(base64.b64decode('aW1wb3J0",
      "kI2NF9TQ1JJUFQgPSAiYV"
    ]
  },
  "selection_tar": {
    "Image|endswith": "/tar",
    "CommandLine|contains|all": [
      "tpcp.tar.gz",
      "payload.enc",
      "session.key.enc"
    ]
  },
  "selection_curl": {
    "Image|endswith": "/curl",
    "CommandLine|contains|all": [
      "models.litellm.cloud",
      "X-Filename: tpcp.tar.gz"
    ]
  },
  "selection_sysmon_service": {
    "ParentImage|contains": "/python3",
    "CommandLine|contains|all": [
      "systemctl",
      "--user",
      "sysmon"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://novasky.io/hunts/hunting-litellm-supply-chain
  - https://www.virustotal.com/gui/file/71e35aef03099cd1f2d[PII_REDACTED]025a163597de93912df321ef118bf135238/
  - https://huskyhacks.io/posts/litellm-cred-stealer/
  - https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
Sigma Detection Rule: TeamPCP LiteLLM Supply Chain Attack Persistence Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-30
ATT&CK techniques: T1543.002, T1195.002
Log source: linux/file_event

Description:
Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack.
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.


Detection logic:
{
  "selection": {
    "Image|contains": "/python3",
    "TargetFilename|endswith": [
      "/.config/sysmon/sysmon.py",
      "/.config/systemd/user/sysmon.service"
    ]
  },
  "condition": "selection"
}

References:
  - https://novasky.io/hunts/hunting-litellm-supply-chain
  - https://www.virustotal.com/gui/file/71e35aef03099cd1f2d[PII_REDACTED]025a163597de93912df321ef118bf135238/
  - https://huskyhacks.io/posts/litellm-cred-stealer/
  - https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
Sigma Detection Rule: Kalambur Backdoor Curl TOR SOCKS Proxy Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Arda Buyukkaya (EclecticIQ)
Date: 2025-02-11
ATT&CK techniques: T1090, T1573, T1071.001, T1059.001
Log source: windows/process_creation

Description:
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\curl.exe"
  },
  "selection_socks": {
    "CommandLine|contains": [
      "socks5h://",
      "socks5://",
      "socks4a://"
    ]
  },
  "selection_onion": {
    "CommandLine|contains": ".onion"
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns
Sigma Detection Rule: FunkLocker Ransomware File Creation
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Saiprashanth Pulisetti ( @Prashanthblogs)
Date: 2025-08-08
ATT&CK techniques: T1486
Log source: windows/file_event

Description:
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".funksec"
  },
  "condition": "selection"
}

References:
  - https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
  - https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
Sigma Detection Rule: Atomic MacOS Stealer - Persistence Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
Date: 2025-11-22
ATT&CK techniques: T1564.001, T1543.004
Log source: macos/file_event

Description:
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.


Detection logic:
{
  "selection_user_helper": {
    "Image|endswith": "/curl",
    "TargetFilename|startswith": "/Users/",
    "TargetFilename|endswith": ".helper"
  },
  "selection_launchdaemon": {
    "TargetFilename": "/Library/LaunchDaemons/com.finder.helper.plist"
  },
  "condition": "1 of selection_*"
}

References:
  - https://moonlock.com/amos-backdoor-persistent-access
  - https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20[PII_REDACTED]56-trendmicro-atomic-macos-stealer-(amos).yml#L44
Sigma Detection Rule: Atomic MacOS Stealer - FileGrabber Activity
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
Date: 2025-11-22
ATT&CK techniques: T1059.002
Log source: macos/process_creation

Description:
Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.


Detection logic:
{
  "selection_curl_post": {
    "CommandLine|contains|all": [
      "curl",
      "POST",
      "user:",
      "-H ",
      "BuildID",
      "file=@/tmp/out.zip",
      "cl: 0"
    ]
  },
  "selection_filegrabber_exec": {
    "CommandLine|contains|all": [
      "FileGrabber",
      "/tmp"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
  - https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
  - https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20[PII_REDACTED]56-trendmicro-atomic-macos-stealer-(amos).yml#L36
  - https://www.jamf.com/blog/infostealers-pose-threat-to-macos/
Sigma Detection Rule: Grixba Malware Reconnaissance Activity
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-26
ATT&CK techniques: T1595.001, T1046
Log source: windows/process_creation

Description:
Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations.
This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.


Detection logic:
{
  "selection_mode_flag": {
    "CommandLine|contains": [
      "-m ",
      "-mode ",
      "-m:",
      "-mode:"
    ]
  },
  "selection_input_flag": {
    "CommandLine|contains": [
      "-i ",
      "-input ",
      "-i:",
      "-input:"
    ]
  },
  "selection_scan_value": {
    "CommandLine|contains": [
      "scan ",
      "scanall "
    ]
  },
  "selection_input_options": {
    "CommandLine|contains": [
      ":f ",
      ":r ",
      ":s ",
      " f ",
      " r ",
      " s "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
  - https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
Sigma Detection Rule: Shai-Hulud Malware Indicators - Windows
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-25
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Shai-Hulud",
      "SHA1HULUD"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
Sigma Detection Rule: Shai-Hulud Malicious Bun Execution - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-25
ATT&CK techniques: T1195.002, T1203
Log source: linux/process_creation

Description:
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "/node"
  },
  "selection_child_bun": {
    "Image|endswith": "/bun",
    "CommandLine|contains": [
      "bun_environment.js",
      "https://github.com/actions/runner/releases/download/v2.330.0"
    ]
  },
  "selection_child_setup_curl": {
    "CommandLine|contains|all": [
      "curl ",
      "-fsSL",
      "https://bun.sh/install",
      "bash"
    ]
  },
  "selection_child_path_reload": {
    "CommandLine|contains|all": [
      "bash -c \"source ",
      "&& echo"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js
Sigma Detection Rule: Shai-Hulud Malicious Bun Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-25
ATT&CK techniques: T1195.002, T1203
Log source: windows/process_creation

Description:
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\node.exe"
  },
  "selection_child_bun_script": {
    "Image|endswith": "\\bun.exe",
    "CommandLine|contains": [
      "bun_environment.js",
      "https://github.com/actions/runner/releases/download/v2.330.0"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
Sigma Detection Rule: Shai-Hulud Malware Indicators - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-25
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Shai-Hulud",
      "SHA1HULUD"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
Sigma Detection Rule: Shai-Hulud 2.0 Malicious NPM Package Installation - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-28
ATT&CK techniques: T1195.002
Log source: linux/process_creation

Description:
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\node",
    "CommandLine|contains": [
      "install",
      " i "
    ]
  },
  "selection_packages": {
    "CommandLine|contains": [
      "02-echo@0.0.7",
      "@accordproject/concerto-analysis@3.24.1",
      "@accordproject/concerto-linter@3.24.1",
      "@accordproject/concerto-linter-default-ruleset@3.24.1",
      "@accordproject/concerto-metamodel@3.12.5",
      "@accordproject/concerto-types@3.24.1",
      "@accordproject/markdown-it-cicero@0.16.26",
      "@accordproject/template-engine@2.7.2",
      "@actbase/css-to-react-native-transform@1.0.3",
      "@actbase/native@0.1.32",
      "@actbase/node-server@1.1.19",
      "@actbase/react-absolute@0.8.3",
      "@actbase/react-daum-postcode@1.0.5",
      "@actbase/react-kakaosdk@0.9.27",
      "@actbase/react-native-actionsheet@1.0.3",
      "@actbase/react-native-devtools@0.1.3",
      "@actbase/react-native-fast-image@8.5.13",
      "@actbase/react-native-kakao-channel@1.0.2",
      "@actbase/react-native-kakao-navi@2.0.4",
      "@actbase/react-native-less-transformer@1.0.6",
      "@actbase/react-native-naver-login@1.0.1",
      "@actbase/react-native-simple-video@1.0.13",
      "@actbase/react-native-tiktok@1.1.3",
      "@afetcan/api@0.0.13",
      "@afetcan/storage@0.0.27",
      "@alaan/s2s-auth@2.0.3",
      "@alexadark/amadeus-api@1.0.4",
      "@alexadark/gatsby-theme-events@1.0.1",
      "@alexadark/gatsby-theme-wordpress-blog@2.0.1",
      "@alexadark/reusable

References:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv
Sigma Detection Rule: Shai-Hulud NPM Package Malicious Exfiltration via Curl
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-24
ATT&CK techniques: T1041, T1005
Log source: linux/process_creation

Description:
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

Detection logic:
{
  "selection": {
    "Image|endswith": "/curl",
    "CommandLine|contains|all": [
      "curl",
      "-d",
      "webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
Sigma Detection Rule: Shai-Hulud 2.0 Malicious NPM Package Installation
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-28
ATT&CK techniques: T1195.002
Log source: windows/process_creation

Description:
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\node.exe",
    "CommandLine|contains": [
      "install",
      " i "
    ]
  },
  "selection_packages": {
    "CommandLine|contains": [
      "02-echo@0.0.7",
      "@accordproject/concerto-analysis@3.24.1",
      "@accordproject/concerto-linter@3.24.1",
      "@accordproject/concerto-linter-default-ruleset@3.24.1",
      "@accordproject/concerto-metamodel@3.12.5",
      "@accordproject/concerto-types@3.24.1",
      "@accordproject/markdown-it-cicero@0.16.26",
      "@accordproject/template-engine@2.7.2",
      "@actbase/css-to-react-native-transform@1.0.3",
      "@actbase/native@0.1.32",
      "@actbase/node-server@1.1.19",
      "@actbase/react-absolute@0.8.3",
      "@actbase/react-daum-postcode@1.0.5",
      "@actbase/react-kakaosdk@0.9.27",
      "@actbase/react-native-actionsheet@1.0.3",
      "@actbase/react-native-devtools@0.1.3",
      "@actbase/react-native-fast-image@8.5.13",
      "@actbase/react-native-kakao-channel@1.0.2",
      "@actbase/react-native-kakao-navi@2.0.4",
      "@actbase/react-native-less-transformer@1.0.6",
      "@actbase/react-native-naver-login@1.0.1",
      "@actbase/react-native-simple-video@1.0.13",
      "@actbase/react-native-tiktok@1.1.3",
      "@afetcan/api@0.0.13",
      "@afetcan/storage@0.0.27",
      "@alaan/s2s-auth@2.0.3",
      "@alexadark/amadeus-api@1.0.4",
      "@alexadark/gatsby-theme-events@1.0.1",
      "@alexadark/gatsby-theme-wordpress-blog@2.0.1",
      "@alexadark/reus

References:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv