Void Dokkaebi - NPM/PyPI Preinstall Reconnaissance

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•9

Identifies package managers (npm, pip) executing pre-install scripts that perform immediate system reconnaissance (whoami, hostname, sw_vers, systeminfo) characteristic of Void Dokkaebi payloads. This rule looks for a sequence where a package manager initiates a process, and that initiated process then launches a reconnaissance command.