PostCSS Typosquat npm/Node.js Spawning PowerShell Download Cradle with TEMP Execution
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
YARA-L
