npm Postinstall Archive Creation After Credential File Access (Friday Harvest/PostCSS RAT)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•7

Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.