Suspicious npm Lifecycle Script Execution with Networking Utility

Ethan Andrews@eandrews

•updated Feb 26, 2026•4•0•56

Detects instances where an npm or node process spawns a shell, which in turn executes a command-line networking utility like curl or wget. This behavior is indicative of a malicious pre/post-install script used in supply chain attacks, such as the one seen with the 'ambar-src' package.