Malicious NPM Lifecycle Hook Execution

Akshay Gaikwad@AkshayGaikwwad

•updated Mar 2, 2026•1•0•45

Detects Node.js package managers (npm, yarn, pnpm) spawning suspicious child processes like network utilities or shells during the installation of a package. This TTP is abused by malicious packages like 'ambar-src' which use 'preinstall' lifecycle scripts to download and execute secondary payloads.