npm RAT C2 Communication via nvidiadriver.net or 95.216.92.207:8080

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.