Suspicious payload.bin Drop in node_modules
Identifies the creation of a stage-2 binary named 'payload.bin' within a 'node_modules' directory. This artifact is dropped by the Gen-1 stager used in the vpmdhaj malicious npm campaign, which targets cloud and CI/CD credentials.
Microsoft Sentinel (KQL)
