alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Shai-Hulud (Here We Go Again) NPM Malware RPC Ethereum Call"; flow:established,to_server; http.request_body; strip_whitespace; content:"|22|method|22 3a 22|eth_call|22|"; content:"|22|to|22 3a 22|0xE1f2395ee43e45A1556EC6438a88c31B83493103|22|"; fast_pattern; content:"|22|data|22 3a 22|0x53ed5143|22|"; http.method; content:"POST"; reference:url,research.jfrog.com/post/shai-hulud-is-back-august/; classtype:command-and-control; sid:2071386; rev:2; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_04, deployment Perimeter, malware_family Shai_Hulud, performance_impact Low, confidence High, signature_severity Critical, updated_at 2026_08_05;)