svn commit: r1928715 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Wed Sep 24 01:28:14 2025
New Revision: 1928715

Log:
Add subrule for eval for emails trying to look like they are from NPMJS

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Wed Sep 24 01:20:45 2025	(r1928714)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Wed Sep 24 01:28:14 2025	(r1928715)
@@ -4502,4 +4502,9 @@ redirector_pattern                     m
 redirector_pattern                     m;^https?://shopper\.digidip\.net/.*[?&]url=(.+);i
 
 
+# npm phishing?
+header     __FROM_NPMJS_SPOOF          From:addr =~ /\@(?:[^.]+\.)*npmjs(?!\.com$|\.org$)[^\.]*\.[^\.>]+>?$/i
+
+
+