Axios NPM Supply Chain Attack - Suspicious npm Lifecycle Script Execution

ᴅᴜᴛᴄʜʙᴏʏ 😎@dutchboy

•updated Apr 21, 2026•22•0•688

This query hunts for potential execution linked to the Axios npm supply chain compromise by detecting node.exe process activity tied to suspicious npm lifecycle markers (postinstall, setup.js, plain-crypto-js). It helps identify systems that may have executed malicious install-time scripts.