Suspicious Preinstall Hook Execution (IronWorm)

Ethan Andrews@eandrews

•updated Jun 4, 2026•1•0•3

Identifies package managers (like npm or yarn) executing suspiciously placed setup binaries from hidden or unconventional folders (e.g., tools/setup, .github/scripts/precheck) indicative of IronWorm preinstall hooks.