Execution Of utils.cjs NPM Dropper Script

Duo Tech@duotech

•updated Jun 8, 2026•3•1•16

Detects Node.js executing the 'utils.cjs' script, which serves as the obfuscated malware dropper for a North Korean-linked infostealer campaign. This script is typically triggered by a malicious npm postinstall hook to download the second-stage payload.