NPM payload writes temporary p JavaScript file
This rule looks for a package writing a short-lived JavaScript file with a p-prefix name in temp during install. That pattern matches known stealers and wipers. Quarantine the package version. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
