SourTrade browser pipeline: /sw.js registration chained to SharedWorker Blob instantiation on non-reputable domain
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
Microsoft Sentinel (KQL)
