Suspicious npm Post-Install Download from Vercel

Ethan Andrews@eandrews

•updated Feb 28, 2026•15•0•147

Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.