Suspicious NPM Install Hook Execution

Elgonad .@elgonad

•updated Mar 5, 2026•2•0•36

Detects the execution of `node` running scripts from a `vendor` directory during an `npm install` lifecycle. This behavior was observed in the StegaBin campaign where malicious npm packages used an install hook to execute a loader from 'vendor/scrypt-js/version.js'.