NullReceiver candidate rules v1.0 — September 6, 2026

These are text-match candidates, not infection verdicts or a complete scanner.
Compiler validation: YARA 4.5.0 compiled these rules in GitHub Actions on
September 6, 2026. Six synthetic positive/negative cases passed (run 34066780798,
commit 0a1801a13a6599922929ce40df4d7e5a38c4eb0a). This is not a real-corpus
accuracy estimate. No local YARA compiler or malware samples were needed.

The Node-font rule needs both folderOpen and an interpreter/font reference.
The literal-wallet rule misses Unicode, Base64 and XOR-obfuscated representations.
The ignore-entry rule matches a repeated editing template and may match research
archives. Broad extension recommendation matches also occur in benign projects.

The separately tested JavaScript extractor covers the known wallet under plaintext,
JS escapes, literal Base64 and whole-wallet single-byte XOR. Its 263 synthetic
checks passed, and a prior 29-artifact comparison preserved false positives and
misses. This is not validation of these YARA rules.

History correlation must compare observed before/after branch heads. YARA does
not search GitHub, detect a force push, prove host execution, or publish reports.

Do not clone or execute target repositories to use these rules. Analyze bounded
in-memory text obtained through approved public-source APIs. Our research never
requests decoded payload servers. Report unavailable/truncated input as unknown.