npm Supply Chain Kill Chain: Postinstall to Credential Exfiltration (4/5 Stages)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.