Suspicious npm Lifecycle Script Execution for Typosquatted Packages

Ethan Andrews@eandrews

•updated May 29, 2026•13•0•35

Identifies npm or node executing lifecycle scripts (e.g., preinstall) for known malicious typosquatted packages. This campaign utilizes these hooks to silently execute a stage-2 credential harvester targeting cloud environments.