NPM Package with Invisible Unicode Injection

Danny Y@zendannyy

•updated Apr 6, 2026•17•0•237

This rule detects the execution of package managers by common parent processes when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.