Mini Shai-Hulud - .npm_npx deep path File Drop Density

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

Identifies rapid dropping of many distinct files deep within the .npm/_npx/ directory structure, a precursor to worm execution. This rule specifically looks for more than 20 distinct file creations within a 5-minute window in paths matching the regex ".npm[\]_npx[\][0-9a-fA-F]+".